Renseignement sur les menaces

États-Unis

152.232.232.39

FAI B2 Net Solutions Inc. Première vue 24/07/2026 01:24 UTC Dernière vue 26/07/2026 05:47 UTC Risque Moyen

Période analysée : 2026-07-19 → 2026-07-26

Activité suspecte — risque 52/100 (Moyen) — MITRE TA0001 — confiance 67 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 52/100 Moyen

Première observation 24/07/2026 01:24 UTC

Dernière observation 26/07/2026 05:47 UTC

Événements (période) 36

MITRE ATT&CK principal TA0007 24 occurrences

Activité suspecte — risque 52/100 (Moyen) — MITRE TA0001 — confiance 67 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « xss_attack » (signaux protocolaires) · confiance 59%

Confiance 67 % — Score WAF 84 · Bonus corrélation +8 · 3 tag(s) WAF

Comparaison ASN / FAI

ASN 55286 · 152.232.232.0/21 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 36 événements sur la période pour cette IP.

152.232.59.229 Cross-site scripting 26/07/2026 18:00 UTC
152.232.59.103 Cross-site scripting 26/07/2026 10:28 UTC
152.232.237.97 Cross-site scripting 26/07/2026 03:41 UTC
72.57.110.145 Cross-site scripting 25/07/2026 17:42 UTC
152.232.54.65 Cross-site scripting 24/07/2026 23:40 UTC
72.57.111.118 Sonde Elasticsearch 24/07/2026 10:10 UTC
192.241.120.184 Cross-site scripting 24/07/2026 06:45 UTC
152.232.238.223 Cross-site scripting 23/07/2026 23:43 UTC

Événements (filtres)

Première observation

24/07/2026 01:24 UTC

Dernière observation

26/07/2026 05:47 UTC

Dernière activité (filtres)

26/07/2026 05:47 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 24 KUBELET READONLY TCP 12

HTTP

KUBELET READONLY

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

B2 Net Solutions Inc. 0 Port 10255 kubernetes_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

xss attack · via HTTP:10255 · (tentative d'exploit) · → /logs/

Détails protocole

Méthode: GET
Chemin: /logs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 …

Aperçu payload

GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTM

Port / service

10255 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0284

Confiance

67% Corrélation +8

Famille de menace

unknown

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

36 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

36 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
26/07/2026 05:47:18 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /logs/	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /logs/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_logs Cible HTTP GET /logs/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /logs/ Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /logs/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTM Requête brute (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "407efa38f347fdc7bcf4ad30f1ca4db656fa89c4", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "6a3a0a8f8e2438fff5a15d99a9a8d4b05eba0362", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 443, "payload_entropy": 5.454780496087243, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 52, "tag_count": 5, "anomaly_count": 0, "campaign_key": "00e3a30d06e86717eab845b47a257182b94cff0d", "event_fingerprint": "601d0ac0f3bc9a63221e521b6ab1a87c268010f6", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c487aa740d1f3628447382b2b1bf90f3", "payload_hash": "d29d94eac3e176ae5c4315f07baccfdb", "path_pattern_hash": "dc3c49e2c93155841e5992c42eedc899" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM", "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM", "evidence": { "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0e682e2373df99ef776dc5f440dd938aba87e1a2", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit\/605.1.15 (KHTM", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_logs", "net_web_probe" ] }
26/07/2026 05:47:16 UTC	TCP	10255 · HTTP	http	Sonde Prometheus prometheus probe · via HTTP:10255 · (sonde / probe) · → /metrics	Élevée	Moyen · 49
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /metrics UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950601:k8s-metrics 950610:prometheus-metrics Cible HTTP GET /metrics TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /metrics Service HTTP Pourquoi cette classification : Type « prometheus_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 50 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux Sonde métriques Prometheus Upstream Tag WAF SQLi (métriques) Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) CRS 941130 Probe /metrics Ligne de requête `GET /metrics HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-metrics prometheus-metrics Payload (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, Requête brute (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp, Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020", "emulator_response_len": 154, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "7edfc244708a7b5c7d4b4385c178aa8e03afde7f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 578, "payload_entropy": 5.560138866251807, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 7, "anomaly_count": 0, "campaign_key": "6945c5938a7381c65357347fabf9964e1d6799e7", "event_fingerprint": "b1c8a13ce1a03c19184007375cbf0de0661f1e3c", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 87, "precision_signals": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "kb_rule_ids": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "matched_patterns": [ "pat-0284", "pat-0266" ], "matched_pattern_names": [ "CRS 941130", "Probe \/metrics" ], "pattern_ids": [ "pat-0284", "pat-0266" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "b1b3d53295d2e84777fee5b31b688eb3", "path_pattern_hash": "b4bbca6caf5247626ee41b68231d40e1" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, ", "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "evidence": { "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "365a8b1285cc579384658c10e425a8012a0d00ae", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "tags_summary_labels_fr": [ "Sonde m\u00e9triques Prometheus", "Upstream", "Tag WAF SQLi (m\u00e9triques)" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics", "http_probe_metrics", "http_prometheus_probe", "net_web_probe" ] }
26/07/2026 05:47:13 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /configz	Élevée	Moyen · 42
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /configz UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /configz TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /configz Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 59 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /configz HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Requête brute (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1560e35decbcf1542ae720d76e3937642edcc47f", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "2f66741014c56ac6a0dc7b54853f8275d8b0d3f1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 448, "payload_entropy": 5.457895462057103, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "b3f7668196e71ff119819c935b112c97db4b3d7b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "31c1a326621a7a378f2472b975f86680", "payload_hash": "0d424ecacd43b11f22b8c2ce83447b72", "path_pattern_hash": "382ed721f9fb41e5a1c267f4bdb69d87" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 ", "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15", "evidence": { "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a600b39b2bc4604df8f41af90f33e19613069520", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
26/07/2026 05:47:10 UTC	TCP	10255 · HTTP	http	Sonde Kubernetes API kubernetes probe · via HTTP:10255 · (sonde / probe) · → /pods	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /pods UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /pods TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /pods Service HTTP Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 62 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0653 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kubelet pods CRS 941130 Ligne de requête `GET /pods HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik Requête brute (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif, Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "0630b87aaa3e749af3eb1147feb5ee67126097fa", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "59a6926bbb41b1ddf30b6bc032d8a4223f148f92", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 590, "payload_entropy": 5.570389135448552, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 41, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "dcb8c6d78aa8201502c92db3c3bb45dd3f71cb5d", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 74, "precision_signals": [ "pat-0653" ], "kb_rule_ids": [ "pat-0653" ], "matched_patterns": [ "pat-0653", "pat-0284" ], "matched_pattern_names": [ "Kubelet pods", "CRS 941130" ], "pattern_ids": [ "pat-0653", "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "96c65b69f70dd4c1e9b6e8398497708c", "payload_hash": "871a8792770933029973ba3e0f49fb40", "path_pattern_hash": "1444c195f4233af8530aa1bd4b4e2207" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "evidence": { "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "99c9b1d08f61570458f8058be86bd8c31f6d5eba", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0653" ], "tags_summary_labels_fr": [ "pat-0653" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ] }
26/07/2026 05:47:07 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kubernetes API kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload �˹�jW� d�(eh\|�Wv_��){�L@P �s y@l��H_��o\�S��Ah"�� 0=�� +�/�,�0̨̩��/5��3��zz Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �˹�jW� d�(eh\|�Wv_��){�L@P �s y@l��H_��o\�S��Ah"��0=�� +�/�,�0̨̩��/5��3��zz Requête brute (extrait) �˹�jW� d�(eh\|�Wv_��){�L@P �s y@l��H_��o\�S��Ah"�� 0=�� +�/�,�0̨̩��/5��3��zz��{��H{��k�f� �?1�ZD��9#=��m�Af�e"@n�� }�8�6۠��㘷�� e��"<R㶍��^� ��+>4`L��@e��򋳰�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 1797, "payload_entropy": 7.7840789829883175, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "service_name": "kubelet-readonly", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d230391d65beebfef3091bcb6b466a38", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh\|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001", "evidence": { "request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh\|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001\u0000\u0011\ufffd\u0004\ufffd\u001c{\ufffd\ufffd\ufffd\ufffdH{\ufffd\ufffd\u0014\ufffd\u0010k\b\ufffdf\u001e\ufffd\f\ufffd?1\ufffdZD\ufffd\ufffd\ufffd\u00049\u0003#\u0000=\u0002\ufffd\ufffd\ufffdm\ufffdA\u001cf\ufffde\"@n\ufffd\ufffd\r\ufffd}\u001d\ufffd8\u001a\ufffd6\u06e0\ufffd\ufffd\ufffd\u0018\ufffd\u3637\ufffd\ufffd\te\u0004\ufffd\ufffd\ufffd\ufffd\"<R\u3d8d\ufffd\u0002\ufffd\ufffd^\ufffd\n\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u001b+>4`L\u0001\u0002\ufffd\ufffd\ufffd@e\ufffd\ufffd\ufffd\ud9ef\udcf0\u0010\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh\|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "099f6f8433f3bbed71b21f2555c4aed7ed1e030c", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh\|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffd\u02f9\ufffdjW\ufffd\rd\ufffd(eh\|\ufffdWv_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0=\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd3\ufffd\ufffdzz", "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u02f9\ufffd\u001bjW\ufffd\rd\ufffd(eh\|\ufffdW\u000ev\u0004_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\u0014\ufffd\ufffd\f\ufffd0=\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\u02f9\ufffdjW\ufffd\rd\ufffd(eh\|\ufffdWv_\ufffd\ufffd\ufffd){\ufffdL@P\t\ufffds y@l\ufffd\ufffd\ufffdH_\ufffd\ufffdo\\\ufffdS\ufffd\ufffdAh\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd0=\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd3\ufffd\ufffdzz", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
26/07/2026 05:47:04 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kubernetes API kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload ��b+�:<:��9߯H��m,��iǺɋs&�� ~Tv�'~"��1��Z5R�kuZ˫D��mz�b* �,�+̩�0�/̨� � ��5/�� zz Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��b+�:<:��9߯H��m,��iǺɋs&�� ~Tv�'~"��1��Z5R�kuZ˫D��mz�b* �,�+̩�0�/̨� � ��5/�� zz Requête brute (extrait) ��b+�:<:��9߯H��m,��iǺɋs&�� ~Tv�'~"��1��Z5R�kuZ˫D��mz�b* �,�+̩�0�/̨� � ��5/�� zz� �� h2http/1.1 3+)�� W:0C)��H�Q7�;�TΪ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 3.947314966749976, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "kubelet-readonly", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e11385fad808d8df220d8e26b3893464", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd\ufffd\ufffdW:\u000f0C)\ufffd\u0000\ufffd\ufffdH\ufffdQ7\ufffd;\ufffdT\u03aa", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "56ad130287f8ca8fdacd0f5a39e7a4d35fc4a2b8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffd\ufffdb+\ufffd:<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffdkuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\n\n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffdzz", "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdb+\ufffd:\u0018<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\u001f\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffd\u0011kuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb\u0000\n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdzz\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdb+\ufffd:<:\ufffd\ufffd9\u07efH\ufffd\ufffd\ufffdm,\ufffd\ufffdi\u01fa\u024bs&\ufffd\ufffd \ufffd\ufffd~Tv\ufffd'~\"\ufffd\ufffd1\ufffd\ufffdZ5R\ufffdkuZ\u02ebD\ufffd\ufffd\ufffdmz\ufffdb*\n\n\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffdzz", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
25/07/2026 20:05:52 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /logs/	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /logs/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/2… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_logs Cible HTTP GET /logs/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /logs/ Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /logs/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Requête brute (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: g Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1717c91603374a2713abf37a2bbc8366d67dc83b", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "6a3a0a8f8e2438fff5a15d99a9a8d4b05eba0362", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 419, "payload_entropy": 5.382751726410476, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 52, "tag_count": 5, "anomaly_count": 0, "campaign_key": "00e3a30d06e86717eab845b47a257182b94cff0d", "event_fingerprint": "601d0ac0f3bc9a63221e521b6ab1a87c268010f6", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "227d0b9a32e1493feff52e0e93f6dec6", "payload_hash": "889d3c0624fa22e5665689d655d5fa91", "path_pattern_hash": "dc3c49e2c93155841e5992c42eedc899" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 ", "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: g", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101", "evidence": { "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: g", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8d6ce582fc9b71272aa75b7579a8d8eaa697ba17", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_logs", "net_web_probe" ] }
25/07/2026 20:05:50 UTC	TCP	10255 · HTTP	http	Sonde Prometheus prometheus probe · via HTTP:10255 · (sonde / probe) · → /metrics	Élevée	Moyen · 49
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /metrics UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950601:k8s-metrics 950610:prometheus-metrics Cible HTTP GET /metrics TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /metrics Service HTTP Pourquoi cette classification : Type « prometheus_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 50 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux Sonde métriques Prometheus Upstream Tag WAF SQLi (métriques) Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) CRS 941130 Probe /metrics Ligne de requête `GET /metrics HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0 Règles WAF rce-0 nosqli-3 k8s-metrics prometheus-metrics Payload (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Fi Requête brute (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzi Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020", "emulator_response_len": 154, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "645a13880dcb9457505909b589edb4ec45ef293f", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "7edfc244708a7b5c7d4b4385c178aa8e03afde7f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 417, "payload_entropy": 5.418755869797821, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 7, "anomaly_count": 0, "campaign_key": "6945c5938a7381c65357347fabf9964e1d6799e7", "event_fingerprint": "b1c8a13ce1a03c19184007375cbf0de0661f1e3c", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 87, "precision_signals": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "kb_rule_ids": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "matched_patterns": [ "pat-0284", "pat-0266" ], "matched_pattern_names": [ "CRS 941130", "Probe \/metrics" ], "pattern_ids": [ "pat-0284", "pat-0266" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ad4ca8ea7bc1709e8f7bb1ddff78c190", "payload_hash": "6b55ba8864d9dfc455203cd642bd9683", "path_pattern_hash": "b4bbca6caf5247626ee41b68231d40e1" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Fi", "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzi", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Fi", "evidence": { "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzi", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Fi", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9786c59df8e3bead9fc0b27e7380de58699db53e", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Fi", "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "tags_summary_labels_fr": [ "Sonde m\u00e9triques Prometheus", "Upstream", "Tag WAF SQLi (m\u00e9triques)" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Fi", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics", "http_probe_metrics", "http_prometheus_probe", "net_web_probe" ] }
25/07/2026 20:05:46 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /configz	Élevée	Moyen · 42
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /configz UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /configz TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /configz Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 59 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /configz HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko Requête brute (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "2f66741014c56ac6a0dc7b54853f8275d8b0d3f1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 567, "payload_entropy": 5.585028651888357, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "b3f7668196e71ff119819c935b112c97db4b3d7b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "72d43eb808798db218d063798749cc39", "payload_hash": "35ac6eb55e7575c2f4da7a9d7c86e2b9", "path_pattern_hash": "382ed721f9fb41e5a1c267f4bdb69d87" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "evidence": { "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3b6732fd9374ac14a5542acaf16224a6dd371d6d", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
25/07/2026 20:05:44 UTC	TCP	10255 · HTTP	http	Sonde Kubernetes API kubernetes probe · via HTTP:10255 · (sonde / probe) · → /pods	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /pods UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /pods TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /pods Service HTTP Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 62 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0653 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kubelet pods CRS 941130 Ligne de requête `GET /pods HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik Requête brute (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "e1bd552d7c59ac5400a54b2a889e10afc4986d30", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "59a6926bbb41b1ddf30b6bc032d8a4223f148f92", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 576, "payload_entropy": 5.566408612884343, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 41, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "dcb8c6d78aa8201502c92db3c3bb45dd3f71cb5d", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 74, "precision_signals": [ "pat-0653" ], "kb_rule_ids": [ "pat-0653" ], "matched_patterns": [ "pat-0653", "pat-0284" ], "matched_pattern_names": [ "Kubelet pods", "CRS 941130" ], "pattern_ids": [ "pat-0653", "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1bcc9eae1df41fe351c44a7626592eb7", "payload_hash": "0abc863bf54c458764a6d17f43e4c68e", "path_pattern_hash": "1444c195f4233af8530aa1bd4b4e2207" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "evidence": { "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cf99f66f3038ba11ea1f89c81ca60446381d008a", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0653" ], "tags_summary_labels_fr": [ "pat-0653" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, lik", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 20:05:42 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kubernetes API kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload zv�L?�V�� 7چH��W��Yݵ�� Z �q�[V��S�@ ��wN�E��u��"�+�/̨̩�,�0� � ��/5 � Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) zv�L?�V�� 7چH��W��Yݵ�� Z �q�[V��S�@ ��wN�E��u��"�+�/̨̩�,�0� � ��/5� Requête brute (extrait) zv�L?�V�� 7چH��W��Yݵ�� Z �q�[V��S�@ ��wN�E��u��"�+�/̨̩�,�0� � ��/5 � # h2http/1.1" 3ki ��\�rh�5��nP��q�+LmURA��k��N��8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 639, "payload_entropy": 7.195301636386135, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "service_name": "kubelet-readonly", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "71d6d360c1d9067ecaecd4af7d21d187", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\ufffdL\u0019\u000f?\ufffdV\ufffd\ufffd\ufffd\t\u000e\ufffd\ufffd\ufffd7\u0686H\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffdY\u0775\ufffd\u0012\ufffd \ufffdZ\t\ufffdq\ufffd[V\u001c\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd@\r\u0001\ufffd\ufffdwN\ufffdE\ufffd\u0002\ufffdu\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\ufffdL\u0019\u000f?\ufffdV\ufffd\ufffd\ufffd\t\u000e\ufffd\ufffd\ufffd7\u0686H\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffdY\u0775\ufffd\u0012\ufffd \ufffdZ\t\ufffdq\ufffd[V\u001c\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd@\r\u0001\ufffd\ufffdwN\ufffdE\ufffd\u0002\ufffdu\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\u000e\u0000\f\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\"\u0000\n\u0000\b\u0004\u0003\u0005\u0003\u0006\u0003\u0002\u0003\u00003\u0000k\u0000i\u0000\u001d\u0000 \ufffd\u0010\ufffd\u0003\ufffd\ufffd\ufffd\\\ufffdrh\ufffd5\ufffd\u0016\ufffd\ufffd\ufffdnP\ufffd\ufffd\ufffd\bq\ufffd+LmUR\u0000\u0017\u0000A\u0004\u0019\ufffd\ufffd\ufffdk\ufffd\u001b\ufffd\ufffdN\ufffd\u0014\ufffd8", "payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\ufffdL\u0019\u000f?\ufffdV\ufffd\ufffd\ufffd\t\u000e\ufffd\ufffd\ufffd7\u0686H\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffdY\u0775\ufffd\u0012\ufffd \ufffdZ\t\ufffdq\ufffd[V\u001c\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd@\r\u0001\ufffd\ufffdwN\ufffdE\ufffd\u0002\ufffdu\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7550747c4d9484353b95d48ae3ab6a82ae4489b8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\ufffdL\u0019\u000f?\ufffdV\ufffd\ufffd\ufffd\t\u000e\ufffd\ufffd\ufffd7\u0686H\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffdY\u0775\ufffd\u0012\ufffd \ufffdZ\t\ufffdq\ufffd[V\u001c\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd@\r\u0001\ufffd\ufffdwN\ufffdE\ufffd\u0002\ufffdu\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "zv\ufffdL?\ufffdV\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd7\u0686H\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffdY\u0775\ufffd\ufffd \ufffdZ\t\ufffdq\ufffd[V\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd@\r\ufffd\ufffdwN\ufffdE\ufffd\ufffdu\ufffd\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd", "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\ufffdL\u0019\u000f?\ufffdV\ufffd\ufffd\ufffd\t\u000e\ufffd\ufffd\ufffd7\u0686H\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffdY\u0775\ufffd\u0012\ufffd \ufffdZ\t\ufffdq\ufffd[V\u001c\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd@\r\u0001\ufffd\ufffdwN\ufffdE\ufffd\u0002\ufffdu\ufffd\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "zv\ufffdL?\ufffdV\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd7\u0686H\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffdY\u0775\ufffd\ufffd \ufffdZ\t\ufffdq\ufffd[V\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd@\r\ufffd\ufffdwN\ufffdE\ufffd\ufffdu\ufffd\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
25/07/2026 20:05:38 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kubernetes API kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload zv"��̞!0%�� ĮuC�}�ߛ��`R�� F7fݳBR�d�#A��Y��#1��̶�\|O'�"�+�/̨̩�,�0� � ��/5 � Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) zv"��̞!0%�� ĮuC�}�ߛ��`R�� F7fݳBR�d�#A��Y��#1��̶�\|O'�"�+�/̨̩�,�0� � ��/5� Requête brute (extrait) zv"��̞!0%�� ĮuC�}�ߛ��`R�� F7fݳBR�d�#A��Y��#1��̶�\|O'�"�+�/̨̩�,�0� � ��/5 � # h2http/1.1" 3ki $˶�7�XG��o�G��e��cy{û6 A�?�D��[��d)� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 639, "payload_entropy": 7.16716751729492, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "service_name": "kubelet-readonly", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "726856257604f4d0468c0e2600df171b", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\"\ufffd\ufffd\u031e!0%\ufffd\u0011\ufffd\ufffd\ufffd\r\ufffd\u012e\u0003uC\ufffd}\u0007\ufffd\u07db\ufffd\ufffd`R\ufffd\ufffd F7f\u0000\u0773BR\ufffdd\ufffd#A\ufffd\ufffd\ufffdY\ufffd\ufffd#1\ufffd\u0007\ufffd\ufffd\u0336\ufffd\|O'\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\"\ufffd\ufffd\u031e!0%\ufffd\u0011\ufffd\ufffd\ufffd\r\ufffd\u012e\u0003uC\ufffd}\u0007\ufffd\u07db\ufffd\ufffd`R\ufffd\ufffd F7f\u0000\u0773BR\ufffdd\ufffd#A\ufffd\ufffd\ufffdY\ufffd\ufffd#1\ufffd\u0007\ufffd\ufffd\u0336\ufffd\|O'\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\u000e\u0000\f\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\"\u0000\n\u0000\b\u0004\u0003\u0005\u0003\u0006\u0003\u0002\u0003\u00003\u0000k\u0000i\u0000\u001d\u0000 \u0010$\u001c\u02f6\ufffd7\ufffdX\u001bG\ufffd\ufffd\ufffdo\ufffd\u0006G\ufffd\ufffd\ufffde\ufffd\ufffdcy{\u0014\u00fb6\n\u0000\u0017\u0000A\u0004\ufffd?\ufffdD\ufffd\ufffd\ufffd[\ufffd\ufffdd)\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\"\ufffd\ufffd\u031e!0%\ufffd\u0011\ufffd\ufffd\ufffd\r\ufffd\u012e\u0003uC\ufffd}\u0007\ufffd\u07db\ufffd\ufffd`R\ufffd\ufffd F7f\u0000\u0773BR\ufffdd\ufffd#A\ufffd\ufffd\ufffdY\ufffd\ufffd#1\ufffd\u0007\ufffd\ufffd\u0336\ufffd\|O'\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b9aeb0a840d6d03ecbe26b5ea569f6ff0418c978", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\"\ufffd\ufffd\u031e!0%\ufffd\u0011\ufffd\ufffd\ufffd\r\ufffd\u012e\u0003uC\ufffd}\u0007\ufffd\u07db\ufffd\ufffd`R\ufffd\ufffd F7f\u0000\u0773BR\ufffdd\ufffd#A\ufffd\ufffd\ufffdY\ufffd\ufffd#1\ufffd\u0007\ufffd\ufffd\u0336\ufffd\|O'\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "zv\"\ufffd\ufffd\u031e!0%\ufffd\ufffd\ufffd\ufffd\r\ufffd\u012euC\ufffd}\ufffd\u07db\ufffd\ufffd`R\ufffd\ufffd F7f\u0773BR\ufffdd\ufffd#A\ufffd\ufffd\ufffdY\ufffd\ufffd#1\ufffd\ufffd\ufffd\u0336\ufffd\|O'\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd", "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002z\u0001\u0000\u0002v\u0003\u0003\"\ufffd\ufffd\u031e!0%\ufffd\u0011\ufffd\ufffd\ufffd\r\ufffd\u012e\u0003uC\ufffd}\u0007\ufffd\u07db\ufffd\ufffd`R\ufffd\ufffd F7f\u0000\u0773BR\ufffdd\ufffd#A\ufffd\ufffd\ufffdY\ufffd\ufffd#1\ufffd\u0007\ufffd\ufffd\u0336\ufffd\|O'\ufffd\u0000\"\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0002\u000b\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "zv\"\ufffd\ufffd\u031e!0%\ufffd\ufffd\ufffd\ufffd\r\ufffd\u012euC\ufffd}\ufffd\u07db\ufffd\ufffd`R\ufffd\ufffd F7f\u0773BR\ufffdd\ufffd#A\ufffd\ufffd\ufffdY\ufffd\ufffd#1\ufffd\ufffd\ufffd\u0336\ufffd\|O'\ufffd\"\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
25/07/2026 09:54:50 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /logs/	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /logs/ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_logs Cible HTTP GET /logs/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /logs/ Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /logs/ HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li Requête brute (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "6a3a0a8f8e2438fff5a15d99a9a8d4b05eba0362", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 569, "payload_entropy": 5.581151541356091, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 52, "tag_count": 5, "anomaly_count": 0, "campaign_key": "00e3a30d06e86717eab845b47a257182b94cff0d", "event_fingerprint": "601d0ac0f3bc9a63221e521b6ab1a87c268010f6", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3", "payload_hash": "d7c8e4bb1b479fd820472b5b754e0f2e", "path_pattern_hash": "dc3c49e2c93155841e5992c42eedc899" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "evidence": { "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4a24a6b33e7aedf0a8a78b8e9027fdb19dadcb63", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_logs", "net_web_probe" ] }
25/07/2026 09:54:47 UTC	TCP	10255 · HTTP	http	Sonde Prometheus prometheus probe · via HTTP:10255 · (sonde / probe) · → /metrics	Élevée	Moyen · 49
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /metrics UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950601:k8s-metrics 950610:prometheus-metrics Cible HTTP GET /metrics TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /metrics Service HTTP Pourquoi cette classification : Type « prometheus_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 50 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux Sonde métriques Prometheus Upstream Tag WAF SQLi (métriques) Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) CRS 941130 Probe /metrics Ligne de requête `GET /metrics HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Règles WAF rce-0 nosqli-3 k8s-metrics prometheus-metrics Payload (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, Requête brute (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/av Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020", "emulator_response_len": 154, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "7edfc244708a7b5c7d4b4385c178aa8e03afde7f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 594, "payload_entropy": 5.572362830467798, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 7, "anomaly_count": 0, "campaign_key": "6945c5938a7381c65357347fabf9964e1d6799e7", "event_fingerprint": "b1c8a13ce1a03c19184007375cbf0de0661f1e3c", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 87, "precision_signals": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "kb_rule_ids": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "matched_patterns": [ "pat-0284", "pat-0266" ], "matched_pattern_names": [ "CRS 941130", "Probe \/metrics" ], "pattern_ids": [ "pat-0284", "pat-0266" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee", "payload_hash": "655a40dbbdb8c3a30e2431174e017463", "path_pattern_hash": "b4bbca6caf5247626ee41b68231d40e1" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, ", "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/av", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "evidence": { "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/av", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "20fae398bfcfc2802601db5d04dab9a04a1d8045", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "tags_summary_labels_fr": [ "Sonde m\u00e9triques Prometheus", "Upstream", "Tag WAF SQLi (m\u00e9triques)" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics", "http_probe_metrics", "http_prometheus_probe", "net_web_probe" ] }
25/07/2026 09:54:45 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /configz	Élevée	Moyen · 42
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /configz UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /configz TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /configz Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 59 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /configz HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, Requête brute (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/av Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "0630b87aaa3e749af3eb1147feb5ee67126097fa", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "2f66741014c56ac6a0dc7b54853f8275d8b0d3f1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 593, "payload_entropy": 5.571471701169176, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "b3f7668196e71ff119819c935b112c97db4b3d7b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "96c65b69f70dd4c1e9b6e8398497708c", "payload_hash": "d63a6923f0c8f4b39f75695da53d6a0e", "path_pattern_hash": "382ed721f9fb41e5a1c267f4bdb69d87" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, ", "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/av", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "evidence": { "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/av", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "39b1ba9ae67a83a3df66011c6046563695b92e2d", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36 Edg\/135\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
25/07/2026 09:54:41 UTC	TCP	10255 · HTTP	http	Sonde Kubernetes API kubernetes probe · via HTTP:10255 · (sonde / probe) · → /pods	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /pods UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /pods TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /pods Service HTTP Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 62 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0653 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kubelet pods CRS 941130 Ligne de requête `GET /pods HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firef Requête brute (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "b537a727b7efcfbf59f3097a4594fe49e8499b9b", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "59a6926bbb41b1ddf30b6bc032d8a4223f148f92", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 414, "payload_entropy": 5.424583409558648, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 41, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "dcb8c6d78aa8201502c92db3c3bb45dd3f71cb5d", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 74, "precision_signals": [ "pat-0653" ], "kb_rule_ids": [ "pat-0653" ], "matched_patterns": [ "pat-0653", "pat-0284" ], "matched_pattern_names": [ "Kubelet pods", "CRS 941130" ], "pattern_ids": [ "pat-0653", "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "a94861fc8a38a05a7f29da11bd6b4b4f", "payload_hash": "215e8fa236f2115250c689ee1ba62da6", "path_pattern_hash": "1444c195f4233af8530aa1bd4b4e2207" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firef", "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzip, ", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firef", "evidence": { "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzip, ", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firef", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e7e65e202fe2e87bcc484f4631cc893d90cfc19a", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firef", "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0653" ], "tags_summary_labels_fr": [ "pat-0653" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firef", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ] }
25/07/2026 09:54:38 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kafka kafka probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload ��O�=��h ��aH�%�RM �3�x�ȿ%y�< �"keDs��H�=�})j��ԕu��tбfMV9 ��+�/�,�0̨̩��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��O�=��h ��aH�%�RM �3�x�ȿ%y�< �"keDs��H�=�})j��ԕu��tбfMV9 ��+�/�,�0̨̩��/5�� Requête brute (extrait) ��O�=��h ��aH�%�RM �3�x�ȿ%y�< �"keDs��H�=�})j��ԕu��tбfMV9 ��+�/�,�0̨̩��/5�� # h2http/1.1 3+)�� C�!9X�Ь�� \|O�O�w�gE��- Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 3.8017367041998607, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 32, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "kubelet-readonly", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0bcc4c903ef58bf3338e74779f771692", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 32 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdO\ufffd\u0017=\ufffd\ufffdh \ufffd\ufffd\u0019aH\ufffd%\ufffdRM\n\ufffd3\ufffdx\ufffd\u023f%y\ufffd< \ufffd\u0019\"keDs\ufffd\ufffdH\ufffd\u0005=\ufffd})j\ufffd\u0019\ufffd\u0515u\ufffd\ufffdt\u0431fMV9\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdO\ufffd\u0017=\ufffd\ufffdh \ufffd\ufffd\u0019aH\ufffd%\ufffdRM\n\ufffd3\ufffdx\ufffd\u023f%y\ufffd< \ufffd\u0019\"keDs\ufffd\ufffdH\ufffd\u0005=\ufffd})j\ufffd\u0019\ufffd\u0515u\ufffd\ufffdt\u0431fMV9\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 C\ufffd!\u00189X\ufffd\u042c\ufffd\ufffd \|O\ufffdO\ufffdw\ufffdg\u0011E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0003\u0000-\u0000\u0002\u0001", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdO\ufffd\u0017=\ufffd\ufffdh \ufffd\ufffd\u0019aH\ufffd%\ufffdRM\n\ufffd3\ufffdx\ufffd\u023f%y\ufffd< \ufffd\u0019\"keDs\ufffd\ufffdH\ufffd\u0005=\ufffd})j\ufffd\u0019\ufffd\u0515u\ufffd\ufffdt\u0431fMV9\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "395d1b47ae820843f30fc1410efaae53c5ef1054", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdO\ufffd\u0017=\ufffd\ufffdh \ufffd\ufffd\u0019aH\ufffd%\ufffdRM\n\ufffd3\ufffdx\ufffd\u023f%y\ufffd< \ufffd\u0019\"keDs\ufffd\ufffdH\ufffd\u0005=\ufffd})j\ufffd\u0019\ufffd\u0515u\ufffd\ufffdt\u0431fMV9\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffd\ufffd\ufffdO\ufffd=\ufffd\ufffdh \ufffd\ufffdaH\ufffd%\ufffdRM\n\ufffd3\ufffdx\ufffd\u023f%y\ufffd< \ufffd\"keDs\ufffd\ufffdH\ufffd=\ufffd})j\ufffd\ufffd\u0515u\ufffd\ufffdt\u0431fMV9 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdO\ufffd\u0017=\ufffd\ufffdh \ufffd\ufffd\u0019aH\ufffd%\ufffdRM\n\ufffd3\ufffdx\ufffd\u023f%y\ufffd< \ufffd\u0019\"keDs\ufffd\ufffdH\ufffd\u0005=\ufffd})j\ufffd\u0019\ufffd\u0515u\ufffd\ufffdt\u0431fMV9\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdO\ufffd=\ufffd\ufffdh \ufffd\ufffdaH\ufffd%\ufffdRM\n\ufffd3\ufffdx\ufffd\u023f%y\ufffd< \ufffd\"keDs\ufffd\ufffdH\ufffd=\ufffd})j\ufffd\ufffd\u0515u\ufffd\ufffdt\u0431fMV9 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
25/07/2026 09:54:35 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kafka kafka probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload ��Y��1�i��.Ǉ��q��t�؈� t ~v �_ʁ"F�C��&)��[��2��&P�� +�/�,�0̨̩��/53 Pourquoi cette classification :* Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Y��1�i��.Ǉ��q��t�؈�t ~v �_ʁ"F�C��&)��[��2��&P�� +�/�,�0̨̩��/53 Requête brute (extrait) ��Y��1�i��.Ǉ��q��t�؈� t ~v �_ʁ"F�C��&)��[��2��&P�� +�/�,�0̨̩��/53 3��*��g{08#��K.C�ʨ�@�� 韉��W?ˣ�)Xo��1h��}6п/�!D!&��Zk>�Va�`l�DI��p��B-�� Nt)�YX� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 1701, "payload_entropy": 7.751814559483109, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 32, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "kubelet-readonly", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "de3227c39b38385ff3f219f936acaa4b", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 32 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdY\ufffd\ufffd\u0011\ufffd1\u0016\u0003\ufffdi\ufffd\ufffd.\u01c7\ufffd\ufffdq\ufffd\ufffd\ufffdt\ufffd\u0608\ufffd\ft ~\u001dv\t\ufffd_\u0281\"F\ufffdC\ufffd\ufffd\ufffd&)\ufffd\ufffd\u000e\ufffd[\ufffd\ufffd\u000f2\ufffd\ufffd&P\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdY\ufffd\ufffd\u0011\ufffd1\u0016\u0003\ufffdi\ufffd\ufffd.\u01c7\ufffd\ufffdq\ufffd\ufffd\ufffdt\ufffd\u0608\ufffd\ft ~\u001dv\t\ufffd_\u0281\"F\ufffdC\ufffd\ufffd\ufffd&)\ufffd\ufffd\u000e\ufffd[\ufffd\ufffd\u000f2\ufffd\ufffd&P\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0004\ufffd\u0004\ufffd*\u0000\u0001\u0000\u0011\ufffd\u0004\ufffd\ufffdg{08#\u0013\ufffd\ufffdK.C\ufffd\u02a8\ufffd@\ufffd\ufffd\u0018\f\u97c9\u0017\ufffd\ufffd\u0011W?\u02e3\ufffd)Xo\ufffd\ufffd1h\ufffd\ufffd}6\u043f\/\ufffd!D!&\u0016\ufffd\ufffd\ufffdZk>\ufffdVa\u0013\ufffd`l\ufffdDI\ufffd\ufffdp\ufffd\ufffdB\u0013\u001b-\ufffd\u0004\ufffd \ufffd\n\ufffd Nt)\ufffdYX\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdY\ufffd\ufffd\u0011\ufffd1\u0016\u0003\ufffdi\ufffd\ufffd.\u01c7\ufffd\ufffdq\ufffd\ufffd\ufffdt\ufffd\u0608\ufffd\ft ~\u001dv\t\ufffd_\u0281\"F\ufffdC\ufffd\ufffd\ufffd&)\ufffd\ufffd\u000e\ufffd[\ufffd\ufffd\u000f2\ufffd\ufffd&P\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7ab9deff33036679f660b19b9caf24afb1aeb664", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdY\ufffd\ufffd\u0011\ufffd1\u0016\u0003\ufffdi\ufffd\ufffd.\u01c7\ufffd\ufffdq\ufffd\ufffd\ufffdt\ufffd\u0608\ufffd\ft ~\u001dv\t\ufffd_\u0281\"F\ufffdC\ufffd\ufffd\ufffd&)\ufffd\ufffd\u000e\ufffd[\ufffd\ufffd\u000f2\ufffd\ufffd&P\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd1\ufffdi\ufffd\ufffd.\u01c7\ufffd\ufffdq\ufffd\ufffd\ufffdt\ufffd\u0608\ufffdt ~v\t\ufffd_\u0281\"F\ufffdC\ufffd\ufffd\ufffd&)\ufffd\ufffd\ufffd[\ufffd\ufffd2\ufffd\ufffd&P\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53", "attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffdY\ufffd\ufffd\u0011\ufffd1\u0016\u0003\ufffdi\ufffd\ufffd.\u01c7\ufffd\ufffdq\ufffd\ufffd\ufffdt\ufffd\u0608\ufffd\ft ~\u001dv\t\ufffd_\u0281\"F\ufffdC\ufffd\ufffd\ufffd&)\ufffd\ufffd\u000e\ufffd[\ufffd\ufffd\u000f2\ufffd\ufffd&P\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u00063\u001a\u001a\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffd1\ufffdi\ufffd*\ufffd.\u01c7\ufffd\ufffdq\ufffd\ufffd\ufffdt\ufffd\u0608\ufffdt ~v\t\ufffd_\u0281\"F\ufffdC\ufffd\ufffd\ufffd&)\ufffd\ufffd\ufffd[\ufffd\ufffd2\ufffd\ufffd&P\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/53", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
24/07/2026 22:18:55 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /logs/	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /logs/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_logs Cible HTTP GET /logs/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /logs/ Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /logs/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (K Requête brute (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/w Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1560e35decbcf1542ae720d76e3937642edcc47f", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "6a3a0a8f8e2438fff5a15d99a9a8d4b05eba0362", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 446, "payload_entropy": 5.454709896016729, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 52, "tag_count": 5, "anomaly_count": 0, "campaign_key": "00e3a30d06e86717eab845b47a257182b94cff0d", "event_fingerprint": "601d0ac0f3bc9a63221e521b6ab1a87c268010f6", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "31c1a326621a7a378f2472b975f86680", "payload_hash": "04fcb0da663856370e3ccdc26fd5ab69", "path_pattern_hash": "dc3c49e2c93155841e5992c42eedc899" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K", "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K", "evidence": { "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/w", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c6b8000f5a0cc7d49e8ea00a421c7a9c41d7e70b", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (K", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_logs", "net_web_probe" ] }
24/07/2026 22:18:51 UTC	TCP	10255 · HTTP	http	Sonde Prometheus prometheus probe · via HTTP:10255 · (sonde / probe) · → /metrics	Élevée	Moyen · 49
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /metrics UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950601:k8s-metrics 950610:prometheus-metrics Cible HTTP GET /metrics TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /metrics Service HTTP Pourquoi cette classification : Type « prometheus_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 50 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux Sonde métriques Prometheus Upstream Tag WAF SQLi (métriques) Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) CRS 941130 Probe /metrics Ligne de requête `GET /metrics HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-metrics prometheus-metrics Payload (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko Requête brute (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020", "emulator_response_len": 154, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "7edfc244708a7b5c7d4b4385c178aa8e03afde7f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 567, "payload_entropy": 5.577214478524892, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 7, "anomaly_count": 0, "campaign_key": "6945c5938a7381c65357347fabf9964e1d6799e7", "event_fingerprint": "b1c8a13ce1a03c19184007375cbf0de0661f1e3c", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 87, "precision_signals": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "kb_rule_ids": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "matched_patterns": [ "pat-0284", "pat-0266" ], "matched_pattern_names": [ "CRS 941130", "Probe \/metrics" ], "pattern_ids": [ "pat-0284", "pat-0266" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "72d43eb808798db218d063798749cc39", "payload_hash": "37aced21ffda8fd7c6c5264c22df6ded", "path_pattern_hash": "b4bbca6caf5247626ee41b68231d40e1" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "evidence": { "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7dfc450a271bae904fb2fe7cc409114c47e24cd2", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "tags_summary_labels_fr": [ "Sonde m\u00e9triques Prometheus", "Upstream", "Tag WAF SQLi (m\u00e9triques)" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics", "http_probe_metrics", "http_prometheus_probe", "net_web_probe" ] }
24/07/2026 22:18:48 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /configz	Élevée	Moyen · 42
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /configz UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /configz TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /configz Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 59 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /configz HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, Requête brute (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp, Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "e1bd552d7c59ac5400a54b2a889e10afc4986d30", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "2f66741014c56ac6a0dc7b54853f8275d8b0d3f1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 579, "payload_entropy": 5.567593463937739, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "b3f7668196e71ff119819c935b112c97db4b3d7b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1bcc9eae1df41fe351c44a7626592eb7", "payload_hash": "2efc4dcfa4aedd2710d865aefeec7deb", "path_pattern_hash": "382ed721f9fb41e5a1c267f4bdb69d87" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, ", "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "evidence": { "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9c195290d704efabad7fe4c8803d1884696c0b6b", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
24/07/2026 22:18:45 UTC	TCP	10255 · HTTP	http	Sonde Kubernetes API kubernetes probe · via HTTP:10255 · (sonde / probe) · → /pods	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /pods UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /pods TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /pods Service HTTP Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 62 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0653 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kubelet pods CRS 941130 Ligne de requête `GET /pods HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/we Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "59a6926bbb41b1ddf30b6bc032d8a4223f148f92", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 580, "payload_entropy": 5.567844753294077, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 41, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "dcb8c6d78aa8201502c92db3c3bb45dd3f71cb5d", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 74, "precision_signals": [ "pat-0653" ], "kb_rule_ids": [ "pat-0653" ], "matched_patterns": [ "pat-0653", "pat-0284" ], "matched_pattern_names": [ "Kubelet pods", "CRS 941130" ], "pattern_ids": [ "pat-0653", "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de", "payload_hash": "9d98d4fd33ac0c619f7a7b23b02e8f83", "path_pattern_hash": "1444c195f4233af8530aa1bd4b4e2207" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTM", "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/we", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTM", "evidence": { "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/we", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTM", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "445c2eeed8d4ad5f5de648eb2d60f4eeefe083b0", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTM", "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0653" ], "tags_summary_labels_fr": [ "pat-0653" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTM", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ] }
24/07/2026 22:18:42 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kafka kafka probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload ��YRڙ ��/Kdh\��f��W_9�D� ~�3�&O'��7��j�I�1��=�U�� ZZ�+�/�,�0̨̩��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��YRڙ��/Kdh\��f��W_9�D� ~�3�&O'��7��j�I�1��=�U�� ZZ�+�/�,�0̨̩��/5�� Requête brute (extrait) ��YRڙ ��/Kdh\��f��W_9�D� ~�3�&O'��7��j�I�1��=�U�� ZZ�+�/�,�0̨̩��/5�� # h2http/1.1 3+)�� <=��(��c��H[ �P�2 ��h� U- Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 3.7861985046803572, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 32, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "kubelet-readonly", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c175109d6a9bcb990cc4133582f07534", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 32 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdYR\u0699\f\ufffd\ufffd\ufffd\ufffd\/\u001d\u0017Kdh\\\u001c\ufffd\ufffdf\ufffd\ufffd\ufffdW_9\ufffdD\ufffd ~\ufffd3\u001d\ufffd&O\u0017'\ufffd\ufffd\u001f7\ufffd\ufffdj\ufffdI\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd=\ufffdU\ufffd\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdYR\u0699\f\ufffd\ufffd\ufffd\ufffd\/\u001d\u0017Kdh\\\u001c\ufffd\ufffdf\ufffd\ufffd\ufffdW_9\ufffdD\ufffd ~\ufffd3\u001d\ufffd&O\u0017'\ufffd\ufffd\u001f7\ufffd\ufffdj\ufffdI\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd=\ufffdU\ufffd\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd\ufffd\u0002\ufffd\ufffd<=\ufffd\ufffd(\ufffd\ufffdc\ufffd\ufffdH[\u000b\ufffdP\ufffd2\u000b\ufffd\ufffd\ufffdh\u001f\ufffd U\u0000-\u0000\u0002\u0001", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdYR\u0699\f\ufffd\ufffd\ufffd\ufffd\/\u001d\u0017Kdh\\\u001c\ufffd\ufffdf\ufffd\ufffd\ufffdW_9\ufffdD\ufffd ~\ufffd3\u001d\ufffd&O\u0017'\ufffd\ufffd\u001f7\ufffd\ufffdj\ufffdI\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd=\ufffdU\ufffd\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "83c7da446f0f0620d89297fcc9b8bda359b0d475", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdYR\u0699\f\ufffd\ufffd\ufffd\ufffd\/\u001d\u0017Kdh\\\u001c\ufffd\ufffdf\ufffd\ufffd\ufffdW_9\ufffdD\ufffd ~\ufffd3\u001d\ufffd&O\u0017'\ufffd\ufffd\u001f7\ufffd\ufffdj\ufffdI\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd=\ufffdU\ufffd\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffd\ufffdYR\u0699\ufffd\ufffd\ufffd\ufffd\/Kdh\\\ufffd\ufffdf\ufffd\ufffd\ufffdW_9\ufffdD\ufffd ~\ufffd3\ufffd&O'\ufffd\ufffd7\ufffd\ufffdj\ufffdI\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffdU\ufffd\ufffd ZZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0019\ufffdYR\u0699\f\ufffd\ufffd\ufffd\ufffd\/\u001d\u0017Kdh\\\u001c\ufffd\ufffdf\ufffd\ufffd\ufffdW_9\ufffdD\ufffd ~\ufffd3\u001d\ufffd&O\u0017'\ufffd\ufffd\u001f7\ufffd\ufffdj\ufffdI\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd\u001d\ufffd=\ufffdU\ufffd\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdYR\u0699\ufffd\ufffd\ufffd\ufffd\/Kdh\\\ufffd\ufffdf\ufffd\ufffd\ufffdW_9\ufffdD\ufffd ~\ufffd3\ufffd&O'\ufffd\ufffd7\ufffd\ufffdj\ufffdI\ufffd1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=\ufffdU\ufffd\ufffd ZZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
24/07/2026 22:18:38 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kubernetes API kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload ��`��[a�$�E�n�c��r� �9"��ħ�^T�\|ꡒ�RM��`4wJ�"k��ue���,�+̩�0�/̨� � ��5/�� Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��`��[a�$�E�n�c��r� �9"��ħ�^T�\|ꡒ�RM��`4wJ�"k��ue���,�+̩�0�/̨� � ��5/�� Requête brute (extrait) ��`��[a�$�E�n�c��r� �9"��ħ�^T�\|ꡒ�RM��`4wJ�"k��ue���,�+̩�0�/̨� � ��5/�� ZZ h2http/1.1 3+)ZZ +f�N� ��4��G�~ ,�z� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 3.9758570927437455, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "kubelet-readonly", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7028e1911c562cc7bebda1552458d326", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd`\u0012\ufffd\ufffd\ufffd\ufffd[a\u0096\ufffd$\ufffdE\ufffdn\ufffd\u0018c\ufffd\ufffd\u001b\ufffdr\ufffd \ufffd9\"\ufffd\ufffd\u0127\ufffd^T\ufffd\|\ua852\ufffdRM\ufffd\ufffd`4wJ\ufffd\"k\ufffd\ufffdue\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd`\u0012\ufffd\ufffd\ufffd\ufffd[a\u0096\ufffd$\ufffdE\ufffdn\ufffd\u0018c\ufffd\ufffd\u001b\ufffdr\ufffd \ufffd9\"\ufffd\ufffd\u0127\ufffd^T\ufffd\|\ua852\ufffdRM\ufffd\ufffd`4wJ\ufffd\"k\ufffd\ufffdue\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\nZZ\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)ZZ\u0000\u0001\u0000\u0000\u001d\u0000 +f\ufffd\u0013N\u001b\ufffd \ufffd\ufffd4\ufffd\ufffdG\ufffd~\r\u0004,\ufffdz\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd`\u0012\ufffd\ufffd\ufffd\ufffd[a\u0096\ufffd$\ufffdE\ufffdn\ufffd\u0018c\ufffd\ufffd\u001b\ufffdr\ufffd \ufffd9\"\ufffd\ufffd\u0127\ufffd^T\ufffd\|\ua852\ufffdRM\ufffd\ufffd`4wJ\ufffd\"k\ufffd\ufffdue\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "771703e7c5f56c279aae448dd9a6b5d1722855e2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd`\u0012\ufffd\ufffd\ufffd\ufffd[a\u0096\ufffd$\ufffdE\ufffdn\ufffd\u0018c\ufffd\ufffd\u001b\ufffdr\ufffd \ufffd9\"\ufffd\ufffd\u0127\ufffd^T\ufffd\|\ua852\ufffdRM\ufffd\ufffd`4wJ\ufffd\"k\ufffd\ufffdue\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd[a\u0096\ufffd$\ufffdE\ufffdn\ufffdc\ufffd\ufffd\ufffdr\ufffd \ufffd9\"\ufffd\ufffd\u0127\ufffd^T\ufffd\|\ua852\ufffdRM\ufffd\ufffd`4wJ\ufffd\"k\ufffd\ufffdue\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd", "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd`\u0012\ufffd\ufffd\ufffd\ufffd[a\u0096\ufffd$\ufffdE\ufffdn\ufffd\u0018c\ufffd\ufffd\u001b\ufffdr\ufffd \ufffd9\"\ufffd\ufffd\u0127\ufffd^T\ufffd\|\ua852\ufffdRM\ufffd\ufffd`4wJ\ufffd\"k\ufffd\ufffdue\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`\ufffd\ufffd\ufffd\ufffd[a\u0096\ufffd$\ufffdE\ufffdn\ufffdc\ufffd\ufffd\ufffdr\ufffd \ufffd9\"\ufffd\ufffd\u0127\ufffd^T\ufffd\|\ua852\ufffdRM\ufffd\ufffd`4wJ\ufffd\"k\ufffd\ufffdue\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd\ufffd\ufffd", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
24/07/2026 12:00:28 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /logs/	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /logs/ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_logs Cible HTTP GET /logs/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /logs/ Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /logs/ HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li Requête brute (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "6a3a0a8f8e2438fff5a15d99a9a8d4b05eba0362", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 592, "payload_entropy": 5.578037722265038, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 52, "tag_count": 5, "anomaly_count": 0, "campaign_key": "00e3a30d06e86717eab845b47a257182b94cff0d", "event_fingerprint": "601d0ac0f3bc9a63221e521b6ab1a87c268010f6", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee", "payload_hash": "78af6f96cb175338fa9e4dc95d624bd7", "path_pattern_hash": "dc3c49e2c93155841e5992c42eedc899" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "evidence": { "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a4e23a10d9623d527c354d33dd92a55f3fd69d8e", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_logs", "net_web_probe" ] }
24/07/2026 12:00:25 UTC	TCP	10255 · HTTP	http	Sonde Prometheus prometheus probe · via HTTP:10255 · (sonde / probe) · → /metrics	Élevée	Moyen · 49
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /metrics UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950601:k8s-metrics 950610:prometheus-metrics Cible HTTP GET /metrics TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /metrics Service HTTP Pourquoi cette classification : Type « prometheus_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 50 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux Sonde métriques Prometheus Upstream Tag WAF SQLi (métriques) Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) CRS 941130 Probe /metrics Ligne de requête `GET /metrics HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-metrics prometheus-metrics Payload (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (K Requête brute (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020", "emulator_response_len": 154, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "7edfc244708a7b5c7d4b4385c178aa8e03afde7f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 583, "payload_entropy": 5.560065976740656, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 7, "anomaly_count": 0, "campaign_key": "6945c5938a7381c65357347fabf9964e1d6799e7", "event_fingerprint": "b1c8a13ce1a03c19184007375cbf0de0661f1e3c", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 87, "precision_signals": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "kb_rule_ids": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "matched_patterns": [ "pat-0284", "pat-0266" ], "matched_pattern_names": [ "CRS 941130", "Probe \/metrics" ], "pattern_ids": [ "pat-0284", "pat-0266" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de", "payload_hash": "77a881ceaeeef4626836e4dc7b4bfa79", "path_pattern_hash": "b4bbca6caf5247626ee41b68231d40e1" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K", "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K", "evidence": { "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf5896e2613e0bcf17023d642ee715dcd4d3e89b", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K", "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "tags_summary_labels_fr": [ "Sonde m\u00e9triques Prometheus", "Upstream", "Tag WAF SQLi (m\u00e9triques)" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (K", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics", "http_probe_metrics", "http_prometheus_probe", "net_web_probe" ] }
24/07/2026 12:00:23 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /configz	Élevée	Moyen · 42
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /configz UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /configz TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /configz Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 59 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /configz HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, Requête brute (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp, Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "2f66741014c56ac6a0dc7b54853f8275d8b0d3f1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 579, "payload_entropy": 5.574729125224089, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "b3f7668196e71ff119819c935b112c97db4b3d7b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3", "payload_hash": "e5fdb228ad5f3c9888d9ef8f0042c9c7", "path_pattern_hash": "382ed721f9fb41e5a1c267f4bdb69d87" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, ", "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "evidence": { "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "43a81295d17c9e29f61fff39c72c786ba404d5fe", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
24/07/2026 12:00:20 UTC	TCP	10255 · HTTP	http	Sonde Kubernetes API kubernetes probe · via HTTP:10255 · (sonde / probe) · → /pods	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /pods UA Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /pods TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /pods Service HTTP Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 62 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0653 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kubelet pods CRS 941130 Ligne de requête `GET /pods HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, Requête brute (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,imag Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "fbc0a46f9c2e144fc770fef4de21ffe725652a28", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "59a6926bbb41b1ddf30b6bc032d8a4223f148f92", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 586, "payload_entropy": 5.546965236349842, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 41, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "dcb8c6d78aa8201502c92db3c3bb45dd3f71cb5d", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 74, "precision_signals": [ "pat-0653" ], "kb_rule_ids": [ "pat-0653" ], "matched_patterns": [ "pat-0653", "pat-0284" ], "matched_pattern_names": [ "Kubelet pods", "CRS 941130" ], "pattern_ids": [ "pat-0653", "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "6273f9be1b02ca05f8b0ec5ce5b17279", "payload_hash": "53ad8b338a5e685f779f49f642f5caf2", "path_pattern_hash": "1444c195f4233af8530aa1bd4b4e2207" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, ", "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,imag", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML,", "evidence": { "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,imag", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML,", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7209bb9161147b00e194616bbd7ad546b1293b1f", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML,", "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0653" ], "tags_summary_labels_fr": [ "pat-0653" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.\u2026", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML,", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ] }
24/07/2026 12:00:17 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kafka kafka probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload �,��I��%� Qu��`��w0��ُ�q�� q��l��s~��I1� ��А�Uz %�Dv jj�+�/�,�0̨̩��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �,��I��%�Qu��`��w0��ُ�q�� q��l��s~��I1��А�Uz%�Dv jj�+�/�,�0̨̩��/5�� Requête brute (extrait) �,��I��%� Qu��`��w0��ُ�q�� q��l��s~��I1� ��А�Uz %�Dv jj�+�/�,�0̨̩��/5�� # h2http/1.1 3+)�� m�W/�<9h\��!�6��_�&5�x<J- Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 3.7756439790409164, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 32, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "kubelet-readonly", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7699eba5a9c8272e73a7b460038faa08", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 32 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\u0007\ufffdI\ufffd\ufffd%\u0001\ufffd\fQu\ufffd\ufffd`\ufffd\ufffdw0\u0017\ufffd\ufffd\u064f\ufffdq\ufffd\ufffd\ufffd q\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u001bs~\u0001\ufffd\ufffdI1\ufffd\u0017\f\ufffd\ufffd\u0410\ufffdU\u0015z\f%\ufffdDv\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\u0007\ufffdI\ufffd\ufffd%\u0001\ufffd\fQu\ufffd\ufffd`\ufffd\ufffdw0\u0017\ufffd\ufffd\u064f\ufffdq\ufffd\ufffd\ufffd q\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u001bs~\u0001\ufffd\ufffdI1\ufffd\u0017\f\ufffd\ufffd\u0410\ufffdU\u0015z\f%\ufffdDv\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \ufffdm\ufffdW\/\ufffd<9h\\\ufffd\u0013\ufffd\ufffd\ufffd\ufffd!\ufffd\u00186\ufffd\ufffd\ufffd_\ufffd&5\ufffdx<J\u0000-\u0000\u0002\u0001", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\u0007\ufffdI\ufffd\ufffd%\u0001\ufffd\fQu\ufffd\ufffd`\ufffd\ufffdw0\u0017\ufffd\ufffd\u064f\ufffdq\ufffd\ufffd\ufffd q\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u001bs~\u0001\ufffd\ufffdI1\ufffd\u0017\f\ufffd\ufffd\u0410\ufffdU\u0015z\f%\ufffdDv\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "697c6211062ca2972fd551f1dd22e7476e19f51b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\u0007\ufffdI\ufffd\ufffd%\u0001\ufffd\fQu\ufffd\ufffd`\ufffd\ufffdw0\u0017\ufffd\ufffd\u064f\ufffdq\ufffd\ufffd\ufffd q\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u001bs~\u0001\ufffd\ufffdI1\ufffd\u0017\f\ufffd\ufffd\u0410\ufffdU\u0015z\f%\ufffdDv\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffd,\ufffd\ufffdI\ufffd\ufffd%\ufffdQu\ufffd\ufffd`\ufffd\ufffdw0\ufffd\ufffd\u064f\ufffdq\ufffd\ufffd\ufffd q\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffds~\ufffd\ufffdI1\ufffd\ufffd\ufffd\u0410\ufffdUz%\ufffdDv jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003,\ufffd\u0007\ufffdI\ufffd\ufffd%\u0001\ufffd\fQu\ufffd\ufffd`\ufffd\ufffdw0\u0017\ufffd\ufffd\u064f\ufffdq\ufffd\ufffd\ufffd q\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffd\u001bs~\u0001\ufffd\ufffdI1\ufffd\u0017\f\ufffd\ufffd\u0410\ufffdU\u0015z\f%\ufffdDv\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kafka probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd,\ufffd\ufffdI\ufffd\ufffd%\ufffdQu\ufffd\ufffd`\ufffd\ufffdw0\ufffd\ufffd\u064f\ufffdq\ufffd\ufffd\ufffd q\ufffd\ufffd\ufffdl\ufffd\ufffd\ufffds~\ufffd\ufffdI1\ufffd\ufffd\ufffd\u0410\ufffdUz%\ufffdDv jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
24/07/2026 12:00:15 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kubernetes API kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload ��T��d�i8;�Ae��DM��-0A�4QΆ ��4j\|��߱��N�A.ֲ�� B �j �+�/�,�0̨̩��/5��D�h2 Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0607 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��T��d�i8;�Ae��DM��-0A�4QΆ ��4j\|��߱��N�A.ֲ��B �j �+�/�,�0̨̩��/5��D�h2 Requête brute (extrait) ��T��d�i8;�Ae��DM��-0A�4QΆ ��4j\|��߱��N�A.ֲ�� B �j �+�/�,�0̨̩��/5��D�h23�튊��w ��й;j��1�'`߻��:��P�v��gxt��闌�Bύ�d!�)`��ʒ{�cyS��:��d[��ElZ7HJ`�$ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 1797, "payload_entropy": 7.755397232601508, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0607" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "service_name": "kubelet-readonly", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "73b4f7295817c39220faacd4cf4d7e51", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0015\ufffdT\ufffd\u0014\ufffd\ufffdd\ufffdi8;\ufffdAe\ufffd\ufffd\ufffdD\u0018M\ufffd\ufffd-0A\ufffd4Q\u0386 \ufffd\u0007\ufffd\ufffd\u00154j\|\ufffd\ufffd\u07f1\u001f\ufffd\u001d\u0006\ufffdN\ufffd\u0017A.\u05b2\ufffd\ufffd\ufffd\fB\n\ufffdj\u0000 \u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000D\ufffd\u0000\u0005\u0000\u0003\u0002h2\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0015\ufffdT\ufffd\u0014\ufffd\ufffdd\ufffdi8;\ufffdAe\ufffd\ufffd\ufffdD\u0018M\ufffd\ufffd-0A\ufffd4Q\u0386 \ufffd\u0007\ufffd\ufffd\u00154j\|\ufffd\ufffd\u07f1\u001f\ufffd\u001d\u0006\ufffdN\ufffd\u0017A.\u05b2\ufffd\ufffd\ufffd\fB\n\ufffdj\u0000 \u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000D\ufffd\u0000\u0005\u0000\u0003\u0002h2\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u00003\u0004\ufffd\u0004\ud28a\u0000\u0001\u0000\u0011\ufffd\u0004\ufffd\ufffdw\r\u0012\u0014\u0001\ufffd\u0013\ufffd\u0014\ufffd\ufffd\u0439\u0005;\u0019j\ufffd\ufffd1\ufffd\u0005\u000e'`\u0011\u07fb\ufffd\ufffd:\ufffd\ufffdP\ufffd\u0001v\ufffd\ufffd\ufffd\ufffdgxt\ufffd\ufffd\u95cc\u0005\ufffd\u0014B\u0005\u03cd\ufffdd!\ufffd)`\ufffd\u0004\u0017\ufffd\u0004\u0292{\ufffd\u001bcyS\ufffd\ufffd:\ufffd\ufffdd[\b\u0018\ufffd\u001d\ufffd\u001e\ufffd\u0015\ufffd\ufffd\ufffd\u0013E\u000flZ7HJ`\ufffd$", "payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0015\ufffdT\ufffd\u0014\ufffd\ufffdd\ufffdi8;\ufffdAe\ufffd\ufffd\ufffdD\u0018M\ufffd\ufffd-0A\ufffd4Q\u0386 \ufffd\u0007\ufffd\ufffd\u00154j\|\ufffd\ufffd\u07f1\u001f\ufffd\u001d\u0006\ufffdN\ufffd\u0017A.\u05b2\ufffd\ufffd\ufffd\fB\n\ufffdj\u0000 \u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000D\ufffd\u0000\u0005\u0000\u0003\u0002h2\u0000", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d1b7a14b979bcbc765dbf82ed3b9faba61a04d81", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0015\ufffdT\ufffd\u0014\ufffd\ufffdd\ufffdi8;\ufffdAe\ufffd\ufffd\ufffdD\u0018M\ufffd\ufffd-0A\ufffd4Q\u0386 \ufffd\u0007\ufffd\ufffd\u00154j\|\ufffd\ufffd\u07f1\u001f\ufffd\u001d\u0006\ufffdN\ufffd\u0017A.\u05b2\ufffd\ufffd\ufffd\fB\n\ufffdj\u0000 \u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000D\ufffd\u0000\u0005\u0000\u0003\u0002h2\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd\ufffdd\ufffdi8;\ufffdAe\ufffd\ufffd\ufffdDM\ufffd\ufffd-0A\ufffd4Q\u0386 \ufffd\ufffd\ufffd4j\|\ufffd\ufffd\u07f1\ufffd\ufffdN\ufffdA.\u05b2\ufffd\ufffd\ufffdB\n\ufffdj \ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffdD\ufffdh2", "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0607" ], "tags_summary_labels_fr": [ "pat-0607" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003\u0015\ufffdT\ufffd\u0014\ufffd\ufffdd\ufffdi8;\ufffdAe\ufffd\ufffd\ufffdD\u0018M\ufffd\ufffd-0A\ufffd4Q\u0386 \ufffd\u0007\ufffd\ufffd\u00154j\|\ufffd\ufffd\u07f1\u001f\ufffd\u001d\u0006\ufffdN\ufffd\u0017A.\u05b2\ufffd\ufffd\ufffd\fB\n\ufffdj\u0000 \u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000D\ufffd\u0000\u0005\u0000\u0003\u0002h2\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdT\ufffd\ufffd\ufffdd\ufffdi8;\ufffdAe\ufffd\ufffd\ufffdDM\ufffd\ufffd-0A\ufffd4Q\u0386 \ufffd\ufffd\ufffd4j\|\ufffd\ufffd\u07f1\ufffd\ufffdN\ufffdA.\u05b2\ufffd\ufffd\ufffdB\n\ufffdj \ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffdD\ufffdh2", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
24/07/2026 01:24:30 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /logs/	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /logs/ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_logs Cible HTTP GET /logs/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /logs/ Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /logs/ HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li Requête brute (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "6a3a0a8f8e2438fff5a15d99a9a8d4b05eba0362", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 569, "payload_entropy": 5.581151541356091, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 52, "tag_count": 5, "anomaly_count": 0, "campaign_key": "00e3a30d06e86717eab845b47a257182b94cff0d", "event_fingerprint": "601d0ac0f3bc9a63221e521b6ab1a87c268010f6", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3", "payload_hash": "d7c8e4bb1b479fd820472b5b754e0f2e", "path_pattern_hash": "dc3c49e2c93155841e5992c42eedc899" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "evidence": { "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4a24a6b33e7aedf0a8a78b8e9027fdb19dadcb63", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 84, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/", "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, li", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_logs", "net_web_probe" ] }
24/07/2026 01:24:26 UTC	TCP	10255 · HTTP	http	Sonde Prometheus prometheus probe · via HTTP:10255 · (sonde / probe) · → /metrics	Élevée	Moyen · 49
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /metrics UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950601:k8s-metrics 950610:prometheus-metrics Cible HTTP GET /metrics TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /metrics Service HTTP Pourquoi cette classification : Type « prometheus_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 50 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux Sonde métriques Prometheus Upstream Tag WAF SQLi (métriques) Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) CRS 941130 Probe /metrics Ligne de requête `GET /metrics HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0 Règles WAF rce-0 nosqli-3 k8s-metrics prometheus-metrics Payload (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Fi Requête brute (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzi Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020", "emulator_response_len": 154, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "b537a727b7efcfbf59f3097a4594fe49e8499b9b", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "7edfc244708a7b5c7d4b4385c178aa8e03afde7f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 417, "payload_entropy": 5.415909128772178, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 49, "tag_count": 7, "anomaly_count": 0, "campaign_key": "6945c5938a7381c65357347fabf9964e1d6799e7", "event_fingerprint": "b1c8a13ce1a03c19184007375cbf0de0661f1e3c", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 87, "precision_signals": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "kb_rule_ids": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "matched_patterns": [ "pat-0284", "pat-0266" ], "matched_pattern_names": [ "CRS 941130", "Probe \/metrics" ], "pattern_ids": [ "pat-0284", "pat-0266" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "a94861fc8a38a05a7f29da11bd6b4b4f", "payload_hash": "3e0480c2da6e7f261269aab9df9e2e8a", "path_pattern_hash": "b4bbca6caf5247626ee41b68231d40e1" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Fi", "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzi", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Fi", "evidence": { "method": "GET", "path": "\/metrics", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzi", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Fi", "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "18f3d57b778b672ad4149a2669aae4f33adb0b49", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Fi", "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab prometheus_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 49\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "tags_summary_labels_fr": [ "Sonde m\u00e9triques Prometheus", "Upstream", "Tag WAF SQLi (m\u00e9triques)" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "prometheus probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\/20100101 Fi", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950601:k8s-metrics", "950610:prometheus-metrics", "http_probe_metrics", "http_prometheus_probe", "net_web_probe" ] }
24/07/2026 01:24:23 UTC	TCP	10255 · HTTP	http	Cross-site scripting xss attack · via HTTP:10255 · (tentative d'exploit) · → /configz	Élevée	Moyen · 42
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /configz UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /configz TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /configz Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 59 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /configz HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Requête brute (extrait) GET /configz HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1560e35decbcf1542ae720d76e3937642edcc47f", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "2f66741014c56ac6a0dc7b54853f8275d8b0d3f1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 448, "payload_entropy": 5.457895462057103, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "b3f7668196e71ff119819c935b112c97db4b3d7b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "31c1a326621a7a378f2472b975f86680", "payload_hash": "0d424ecacd43b11f22b8c2ce83447b72", "path_pattern_hash": "382ed721f9fb41e5a1c267f4bdb69d87" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 ", "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15", "evidence": { "method": "GET", "path": "\/configz", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configz HTTP\/1.1", "request_sample": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image", "payload_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a600b39b2bc4604df8f41af90f33e19613069520", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15", "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/configz", "request_line": "GET \/configz HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.3 Safari\/605.1.15", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10255 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configz", "evidence_snippet": "GET \/configz HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
24/07/2026 01:24:20 UTC	TCP	10255 · HTTP	http	Sonde Kubernetes API kubernetes probe · via HTTP:10255 · (sonde / probe) · → /pods	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /pods UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /pods TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10255 Chemin / cible /pods Service HTTP Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 62 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0653 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kubelet pods CRS 941130 Ligne de requête `GET /pods HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firef Requête brute (extrait) GET /pods HTTP/1.1 Host: 62.3.50.33:10255 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "645a13880dcb9457505909b589edb4ec45ef293f", "http_host_hash": "23ee11e3646cd39a5b35e9fada819d04c44bd3c5", "http_target_hash": "59a6926bbb41b1ddf30b6bc032d8a4223f148f92", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 414, "payload_entropy": 5.427450779142447, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "http", "app_proto": "http", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 60, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 41, "tag_count": 3, "anomaly_count": 0, "campaign_key": "951497dab2214a79a1c1880f62df932c33516ba1", "event_fingerprint": "dcb8c6d78aa8201502c92db3c3bb45dd3f71cb5d", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 74, "precision_signals": [ "pat-0653" ], "kb_rule_ids": [ "pat-0653" ], "matched_patterns": [ "pat-0653", "pat-0284" ], "matched_pattern_names": [ "Kubelet pods", "CRS 941130" ], "pattern_ids": [ "pat-0653", "pat-0284" ], "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ad4ca8ea7bc1709e8f7bb1ddff78c190", "payload_hash": "1ffead99cfd2ed3180190875064041e9", "path_pattern_hash": "1444c195f4233af8530aa1bd4b4e2207" }, "target_context": { "dst_port": 10255, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firef", "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzip, ", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firef", "evidence": { "method": "GET", "path": "\/pods", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/pods HTTP\/1.1", "request_sample": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/;q=0.8\r\nAccept-Encoding: gzip, ", "payload_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firef", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7a8dc4e5db5872fd78b32226cd6658073619585b", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firef", "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 62, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0653" ], "tags_summary_labels_fr": [ "pat-0653" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/pods", "request_line": "GET \/pods HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0", "port": 10255, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "kubernetes probe \u00b7 via HTTP:10255 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/pods", "evidence_snippet": "GET \/pods HTTP\/1.1\r\nHost: 62.3.50.33:10255\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firef", "target_port_label": "10255 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "kubelet-readonly" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ] }
24/07/2026 01:24:16 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kubernetes API kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload �MX$�늉��xބV��H�BS�~�T�� ,OL/��2 [S��t��v>jV��,�+̩�0�/̨� � ��5/�� * Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �MX$�늉��xބV��H�BS�~�T�� ,OL/��2[S��t��v>jV��,�+̩�0�/̨� � ��5/�� * Requête brute (extrait) �MX$�늉��xބV��H�BS�~�T�� ,OL/��2 [S��t��v>jV��,�+̩�0�/̨� � ��5/�� � ZZ h2http/1.1 3+)ZZ �a��<#�e��1(8v�4�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 3.917958222129266, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "kubelet-readonly", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b056fe7ab5c40b7f98b2309ff4b3e77a", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u000fMX$\ufffd\b\ub289\ufffd\ufffd\b\ufffdx\u0784V\ufffd\ufffd\ufffdH\ufffdBS\ufffd~\ufffdT\ufffd\ufffd\ufffd\ufffd \u000f\ufffd,OL\/\ufffd\ufffd\ufffd\ufffd\ufffd2\f[\u0019S\ufffd\ufffd\u0000\ufffd\ufffdt\ufffd\u0019\ufffd\b\ufffdv>jV\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u000fMX$\ufffd\b\ub289\ufffd\ufffd\b\ufffdx\u0784V\ufffd\ufffd\ufffdH\ufffdBS\ufffd~\ufffdT\ufffd\ufffd\ufffd\ufffd \u000f\ufffd,OL\/\ufffd\ufffd\ufffd\ufffd\ufffd2\f[\u0019S\ufffd\ufffd\u0000\ufffd\ufffdt\ufffd\u0019\ufffd\b\ufffdv>jV\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd*\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\nZZ\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)ZZ\u0000\u0001\u0000\u0000\u001d\u0000 \ufffda\ufffd\ufffd\b\ufffd<#\ufffde\ufffd\ufffd1(8v\ufffd4\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u000fMX$\ufffd\b\ub289\ufffd\ufffd\b\ufffdx\u0784V\ufffd\ufffd\ufffdH\ufffdBS\ufffd~\ufffdT\ufffd\ufffd\ufffd\ufffd \u000f\ufffd,OL\/\ufffd\ufffd\ufffd\ufffd\ufffd2\f[\u0019S\ufffd\ufffd\u0000\ufffd\ufffdt\ufffd\u0019\ufffd\b\ufffdv>jV\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd\u0000\u0000", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8a79c7b32c34ba0a60146e56bc2948c8c9ea1263", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u000fMX$\ufffd\b\ub289\ufffd\ufffd\b\ufffdx\u0784V\ufffd\ufffd\ufffdH\ufffdBS\ufffd~\ufffdT\ufffd\ufffd\ufffd\ufffd \u000f\ufffd,OL\/\ufffd\ufffd\ufffd\ufffd\ufffd2\f[\u0019S\ufffd\ufffd\u0000\ufffd\ufffdt\ufffd\u0019\ufffd\b\ufffdv>jV\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd*\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffdMX$\ufffd\ub289\ufffd\ufffd\ufffdx\u0784V\ufffd\ufffd\ufffdH\ufffdBS\ufffd~\ufffdT\ufffd\ufffd\ufffd\ufffd \ufffd,OL\/\ufffd\ufffd\ufffd\ufffd\ufffd2[S\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffdv>jV\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd*", "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u000fMX$\ufffd\b\ub289\ufffd\ufffd\b\ufffdx\u0784V\ufffd\ufffd\ufffdH\ufffdBS\ufffd~\ufffdT\ufffd\ufffd\ufffd\ufffd \u000f\ufffd,OL\/\ufffd\ufffd\ufffd\ufffd\ufffd2\f[\u0019S\ufffd\ufffd\u0000\ufffd\ufffdt\ufffd\u0019\ufffd\b\ufffdv>jV\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffd*\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdMX$\ufffd\ub289\ufffd\ufffd\ufffdx\u0784V\ufffd\ufffd\ufffdH\ufffdBS\ufffd~\ufffdT\ufffd\ufffd\ufffd\ufffd \ufffd,OL\/\ufffd\ufffd\ufffd\ufffd\ufffd2[S\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\ufffdv>jV\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffd**", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
24/07/2026 01:24:13 UTC	TCP	10255 · KUBELET READONLY	kubelet-readonly	Sonde Kubernetes API kubernetes probe · via KUBELET READONLY:10255 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur KUBELET-READONLY WAF — Recommandation Surveiller Tags kubernetes_probe net_kubernetes_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10255 Chemin / cible — Service KUBELET READONLY Payload ��k�? ��L�<�!��J.�?a�� 9^�펜��R� 9{'�F�c��6&����,�+̩�0�/̨� � ��5/�� ZZ Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��k�? ��L�<�!��J.�?a�� 9^�펜��R� 9{'�F�c��6&����,�+̩�0�/̨� � ��5/�� ZZ Requête brute (extrait) ��k�? ��L�<�!��J.�?a�� 9^�펜��R� 9{'�F�c��6&����,�+̩�0�/̨� � ��5/�� ZZ� :: h2http/1.1 3+):: L�� g� ��Q�r�+��^ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 3.9307032185815323, "port_category": "registered", "org": "B2 Net Solutions Inc.", "service": "kubelet-readonly", "app_proto": "kubelet-readonly", "asn": 55286, "country": "US", "dst_port": 10255, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "99bdf9c0ec97de848f37e5cac984cab8903c27db", "event_fingerprint": "810fa3edfe2b242758b27e6e9e5b2ad29d52024b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "kubelet-readonly", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 55286, "org": "B2 Net Solutions Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7576104eb27bbbc85e3c01b8d28e50a6", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 10255, "service": "kubelet-readonly", "service_name": "kubelet-readonly", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk\ufffd? \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd<\ufffd!\ufffd\ufffd\ufffd\u0013\ufffd\u0005J.\ufffd?\u0004a\ufffd\ufffd\ufffd 9^\u0001\ufffd\ud39c\ufffd\ufffd\ufffdR\ufffd\r\u00009{'\ufffdF\u0014\ufffdc\ufffd\ufffd6&\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdZZ\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk\ufffd? \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd<\ufffd!\ufffd\ufffd\ufffd\u0013\ufffd\u0005J.\ufffd?\u0004a\ufffd\ufffd\ufffd 9^\u0001\ufffd\ud39c\ufffd\ufffd\ufffdR\ufffd\r\u00009{'\ufffdF\u0014\ufffdc\ufffd\ufffd6&\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdZZ\u0000\u0000\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\f\u0000\n::\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0018\u0000\u0016\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\u0002\u0003\b\u0005\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0002\u0001\u0000\u0012\u0000\u0000\u00003\u0000+\u0000)::\u0000\u0001\u0000\u0000\u001d\u0000 L\ufffd\ufffd\ufffd\u0000\f\ufffd\ufffd\ufffd\u0019g\ufffd\t\ufffd\ufffdQ\ufffdr\ufffd+\ufffd\ufffd^", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk\ufffd? \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd<\ufffd!\ufffd\ufffd\ufffd\u0013\ufffd\u0005J.\ufffd?\u0004a\ufffd\ufffd\ufffd 9^\u0001\ufffd\ud39c\ufffd\ufffd\ufffdR\ufffd\r\u00009{'\ufffdF\u0014\ufffdc\ufffd\ufffd6&\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdZZ\u0000\u0000", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "56f1373ae9526c2a1dca70160b02c4b184afeaac", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk\ufffd? \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd<\ufffd!\ufffd\ufffd\ufffd\u0013\ufffd\u0005J.\ufffd?\u0004a\ufffd\ufffd\ufffd 9^\u0001\ufffd\ud39c\ufffd\ufffd\ufffdR\ufffd\r\u00009{'\ufffdF\u0014\ufffdc\ufffd\ufffd6&\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdZZ\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "evidence_snippet": "\ufffd\ufffd\ufffdk\ufffd? \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd<\ufffd!\ufffd\ufffd\ufffd\ufffdJ.\ufffd?a\ufffd\ufffd\ufffd 9^\ufffd\ud39c\ufffd\ufffd\ufffdR\ufffd\r9{'\ufffdF\ufffdc\ufffd\ufffd6&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffdZZ", "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "kubelet-readonly", "service_label_fr": "KUBELET READONLY", "dst_port": 10255, "protocol_emulated": true, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-kubelet-readonly", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdk\ufffd? \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd<\ufffd!\ufffd\ufffd\ufffd\u0013\ufffd\u0005J.\ufffd?\u0004a\ufffd\ufffd\ufffd 9^\u0001\ufffd\ud39c\ufffd\ufffd\ufffdR\ufffd\r\u00009{'\ufffdF\u0014\ufffdc\ufffd\ufffd6&\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\u0014\ufffd\u0013\u0000\ufffd\u0000\ufffd\u00005\u0000\/\ufffd\b\ufffd\u0012\u0000\n\u0001\u0000\u0001\ufffdZZ\u0000\u0000", "port": 10255, "service": "kubelet-readonly", "service_label_fr": "KUBELET READONLY" }, "attack_vector": "kubernetes probe \u00b7 via KUBELET READONLY:10255 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdk\ufffd? \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd<\ufffd!\ufffd\ufffd\ufffd\ufffdJ.\ufffd?a\ufffd\ufffd\ufffd 9^\ufffd\ud39c\ufffd\ufffd\ufffdR\ufffd\r9{'\ufffdF\ufffdc\ufffd\ufffd6&\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd5\/\ufffd\ufffd\n\ufffdZZ", "target_port_label": "10255 \u00b7 KUBELET READONLY", "emulator_service": "kubelet-readonly", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "kubelet_readonly", "service_banner": "honeypot-kubelet-readonly", "service_os": "linux", "dst_port": "10255" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }

152.232.232.39

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence