Renseignement sur les menaces

États-Unis

152.32.183.209

FAI UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED Première vue 03/01/2026 01:06 UTC Dernière vue 29/07/2026 22:04 UTC Risque Critique

Période analysée : 2026-07-01 → 2026-07-31

Activité suspecte — risque 50/100 (Moyen) — MITRE TA0007 — confiance 100 % — via UPNP TCP

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

100

Critique · Risque max (7j) Critique

Synthèse exécutive

Profil de menace

Score de risque 100/100 Critique

Première observation 03/01/2026 01:06 UTC

Dernière observation 29/07/2026 22:04 UTC

Événements (période) 23

MITRE ATT&CK principal TA0007 15 occurrences

Activité suspecte — risque 50/100 (Moyen) — MITRE TA0007 — confiance 100 % — via UPNP TCP

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « rdp_probe » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8

Comparaison ASN / FAI

ASN 135377 · 152.32.183.0/24 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 23 événements sur la période pour cette IP.

118.193.36.107 Tentative d'exploit 31/07/2026 14:44 UTC
152.32.235.160 Tentative d'exploit 31/07/2026 14:40 UTC
165.154.11.170 Sonde PostgreSQL 31/07/2026 14:37 UTC
101.36.97.172 Sonde port 31/07/2026 14:34 UTC
152.32.157.3 Sonde port 31/07/2026 14:32 UTC
156.229.16.142 Sonde PostgreSQL 31/07/2026 14:31 UTC
118.194.250.245 Sonde port 31/07/2026 14:25 UTC
152.32.234.184 Sonde Kubernetes API 31/07/2026 14:21 UTC

Événements (filtres)

Première observation

03/01/2026 01:06 UTC

Dernière observation

29/07/2026 22:04 UTC

Dernière activité (filtres)

29/07/2026 22:04 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

UPNP TCP TCP 10 HTTP TCP 9 WEBLOGIC CLUSTER TCP 2 TLS TCP 1

UPNP TCP

HTTP

WEBLOGIC CLUSTER

TLS

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 280 Port 5001 postgres_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

rdp probe · via UPNP TCP:5001 · (sonde / probe)

Détails protocole

Aperçu payload

3.�Cookie: mstshash=Administrator

Port / service

5001 · UPNP TCP

Service émulé

UPNP-TCP

Raison confiance

Confiance 100 % — Motif catalogue confirmé

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0347 pat-0348

Confiance

100%

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

23 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

23 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
29/07/2026 22:04:56 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Sonde RDP rdp probe · via UPNP TCP:5001 · (sonde / probe)	Faible	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur UPNP-TCP WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload � Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0348 pat-0352 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP TPKT header RDP negotiation ET H.323 setup Mumble ping Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 11, "payload_entropy": 1.6729330318733675, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 50, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0348", "pat-0352" ], "kb_rule_ids": [ "pat-0348", "pat-0352" ], "matched_patterns": [ "pat-0348", "pat-0352", "pat-0868", "pat-0768", "pat-0554" ], "matched_pattern_names": [ "RDP TPKT header", "RDP negotiation", "ET H.323 setup", "Mumble ping", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0348", "pat-0352", "pat-0868", "pat-0768", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6771a78868614c6768349c36da4591da", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e5c0acaf1d98db6fdb3383f39c0d6b98695f6d97", "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "\ufffd", "attack_vector": "rdp probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via UPNP TCP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "pat-0348", "pat-0352" ], "tags_summary_labels_fr": [ "pat-0348", "pat-0352" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u0000\u000b\u0006\ufffd\u0000\u0000\u0000\u0000\u0000", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "rdp probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate" }
29/07/2026 22:04:56 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Sonde RDP rdp probe · via UPNP TCP:5001 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur UPNP-TCP WAF — Recommandation Investiguer Tags net_tor_exit_probe tor_exit_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload 3.�Cookie: mstshash=Administrator Pourquoi cette classification : Type « rdp_probe » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0347 pat-0348 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) RDP NTLM hash RDP TPKT header ET H.323 setup Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) 3.�Cookie: mstshash=Administrator Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 51, "payload_entropy": 4.196264312262785, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 50, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b8802baad5a7e519bd43629375cdee8e2d429c95", "event_fingerprint": "6c097e3287334ec7ee77aab782f9ffdd1351837a", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 116, "precision_signals": [ "pat-0347", "pat-0348" ], "kb_rule_ids": [ "pat-0347", "pat-0348" ], "matched_patterns": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "matched_pattern_names": [ "RDP NTLM hash", "RDP TPKT header", "ET H.323 setup", "Minecraft varint handshake" ], "pattern_ids": [ "pat-0347", "pat-0348", "pat-0868", "pat-0554" ], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "31041a19e88e2021906e85657a585dd2", "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 50 }, "payload_preview": "\u0003\u0000\u00003.\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "request_sample": "\u0003\u0000\u00003.\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u00003.\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "evidence": { "request_sample": "\u0003\u0000\u00003.\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "payload_snippet": "\u0003\u0000\u00003.\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9dbb85db40850880a769e442eaa3d336abd745b6", "protocol_details": { "payload_preview": "\u0003\u0000\u00003.\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "3.\ufffdCookie: mstshash=Administrator", "attack_vector": "rdp probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via UPNP TCP", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "pat-0347", "pat-0348" ], "tags_summary_labels_fr": [ "pat-0347", "pat-0348" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0003\u0000\u00003.\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administrator\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "rdp probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "evidence_snippet": "3.\ufffdCookie: mstshash=Administrator", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_tor_exit_probe", "tor_exit_probe" ] }
29/07/2026 22:04:55 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Requête CoAP GET coap get · via UPNP TCP:5001 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags coap_get net_coap_get Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload {13911111112��{ Pourquoi cette classification : Type « coap_get » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 33 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) {13911111112��{ Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 22, "payload_entropy": 3.061482186720775, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.3, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 33, "tag_count": 2, "anomaly_count": 0, "campaign_key": "d0499fd7e6e6cb6b5bd08eedf143476fe164fb3c", "event_fingerprint": "2c553946350713ea2fa44c61da1aa254ee6d336c", "classification_reason": "Type \u00ab coap_get \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7dcb4d74c6da4506f1b926d885102350", "path_pattern_hash": "d6cd64a05b2514923dba36ea271180b3" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 33 }, "payload_preview": "{\u0001\u0000\u001613911111112\ufffd\ufffd\u0001\u0001\u0013\ufffd{", "request_sample": "{\u0001\u0000\u001613911111112\ufffd\ufffd\u0001\u0001\u0013\ufffd{", "payload_snippet": "{\u0001\u0000\u001613911111112\ufffd\ufffd\u0001\u0001\u0013\ufffd{", "evidence": { "request_sample": "{\u0001\u0000\u001613911111112\ufffd\ufffd\u0001\u0001\u0013\ufffd{", "payload_snippet": "{\u0001\u0000\u001613911111112\ufffd\ufffd\u0001\u0001\u0013\ufffd{", "classification_reason": "Type \u00ab coap_get \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c0ac2aedae5cde71bba6c198b6dad05d493410be", "protocol_details": { "payload_preview": "{\u0001\u0000\u001613911111112\ufffd\ufffd\u0001\u0001\u0013\ufffd{", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "{13911111112\ufffd\ufffd\ufffd{", "attack_vector": "coap get \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab coap_get \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab coap_get \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "{\u0001\u0000\u001613911111112\ufffd\ufffd\u0001\u0001\u0013\ufffd{", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "coap get \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "evidence_snippet": "{13911111112\ufffd\ufffd\ufffd{", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "coap_get", "net_coap_get" ] }
29/07/2026 22:04:55 UTC	TCP	5001 · UPNP TCP	upnp-tcp	SSRF interne ssrf internal · via UPNP TCP:5001 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload GET / HTTP/1.1 Host: 62.3.50.33:5001 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 User-Agent: Mozilla/5.0 Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54% Confiance classification 54% Risque capteur Moyen · 46 Confiance : Confiance 54 % — Motif catalogue confirmé Protocole émulé 1 Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) SSRF Any-address SSRF User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5001 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 User-Agent: Mozilla/5.0 Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5001 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 252, "payload_entropy": 5.4824552130460305, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "026f36b3ffe414862f6c505b08a38f2a9ee910e5", "event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "confidence": 0.54, "classification_confidence": 0.54, "precision_score": 64, "precision_signals": [ "CRS-920350" ], "kb_rule_ids": [ "CRS-920350" ], "matched_patterns": [ "pat-0324" ], "matched_pattern_names": [ "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0324" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "classification_parent": "ssrf_attack", "service_name": "upnp-tcp", "risk_confidence_factor": 54, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "02f768feef681de46a93408ead8e4d07", "path_pattern_hash": "2926fa5ba65a298fe7630f4e1d1dd6ea" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "76eabb211b919f507340f1767e5df0b3c7e39829", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "attack_vector": "ssrf internal \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via UPNP TCP", "confidence_pct": 54, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "CRS-920350" ], "tags_summary_labels_fr": [ "CRS-920350" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "ssrf internal \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
29/07/2026 22:04:55 UTC	TCP	5001 · UPNP TCP	upnp-tcp	upnp-tcp upnp-tcp · via UPNP TCP:5001 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Pourquoi cette classification : Type « upnp-tcp » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 4, "payload_entropy": 1, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dba5166ad9db9ba648c1032ebbd34dcd", "path_pattern_hash": "0dc6bbf1117b9a1ab96b1de856cf3e22" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 0 }, "payload_preview": "\r\n\r\n", "request_sample": "\r\n\r\n", "evidence": { "request_sample": "\r\n\r\n", "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad3ca22949c1fd72f415e030de131ce5ade0a203", "protocol_details": { "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/07/2026 22:04:55 UTC	TCP	5001 · UPNP TCP	upnp-tcp	upnp-tcp upnp-tcp · via UPNP TCP:5001 · (sonde / probe)	Faible	Faible · 5
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload � github.comPGET / HTTP/1.0 Pourquoi cette classification : Type « upnp-tcp » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 5 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0567 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) � github.comPGET / HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 41, "payload_entropy": 4.668169992264659, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15 }, "risk_score": 5, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0567" ], "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 5 }, "service_name": "upnp-tcp", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8d2aa942c0253edc4af921e0db63ab91", "path_pattern_hash": "0dc6bbf1117b9a1ab96b1de856cf3e22" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 5 }, "payload_preview": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngithub.com\u0000PGET \/ HTTP\/1.0\r\n\r\n", "request_sample": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngithub.com\u0000PGET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngithub.com\u0000PGET \/ HTTP\/1.0", "evidence": { "request_sample": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngithub.com\u0000PGET \/ HTTP\/1.0\r\n\r\n", "payload_snippet": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngithub.com\u0000PGET \/ HTTP\/1.0", "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "db860ef51d5e8c4388b73af8751f6f296335a92f", "protocol_details": { "payload_preview": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngithub.com\u0000PGET \/ HTTP\/1.0", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "\ufffd\ngithub.comPGET \/ HTTP\/1.0", "attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 5, "risk_label": "Faible", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "pat-0567" ], "tags_summary_labels_fr": [ "pat-0567" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0004\u0000\u0001\u0002\ufffd\u0005\u0001\u0000\u0003\ngithub.com\u0000PGET \/ HTTP\/1.0", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ngithub.comPGET \/ HTTP\/1.0", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/07/2026 22:04:54 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Sonde Kafka kafka probe · via UPNP TCP:5001 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload �� MMS�� NSPlayer/9...98; {AA-A-a-AAA- Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key RADIUS Access-Request Minecraft varint handshake TFTP RRQ WireGuard handshake User-Agent — Règles WAF — Payload (extrait) ��MMS��NSPlayer/9...98; {AA-A-a-AAA- Requête brute (extrait) �� MMS�� NSPlayer/9...98; {AA-A-a-AAA-AAAAA}�m�_ Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 151, "payload_entropy": 2.9394053309596297, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0577", "pat-0554", "pat-0536", "pat-0623" ], "matched_pattern_names": [ "Kafka ApiVersions key", "RADIUS Access-Request", "Minecraft varint handshake", "TFTP RRQ", "WireGuard handshake" ], "pattern_ids": [ "pat-0556", "pat-0577", "pat-0554", "pat-0536", "pat-0623" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "40d2dbc3799fc4c078b732b44566c778", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 32 }, "payload_snippet": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000", "evidence": { "request_sample": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000\u0000\u0000A\u0000\u0000A\u0000A\u0000\u0000A\u0000A\u0000\u0000}\u0000\u0000\u0000\ufffdm\ufffd_", "payload_snippet": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "96473b2964e7c8cbeeafb2cfbedbf024283faa3e", "protocol_details": { "payload_preview": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdMMS\ufffd\ufffd\ufffd\ufffdNSPlayer\/9...98; {AA-A-a-AAA-", "attack_vector": "kafka probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0001\u0000\u0000\ufffd\ufffd\ufffd\u000b\ufffd\ufffd\u0000\u0000\u0000MMS\u0014\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0001\u0000\u0003\u0000\ufffd\ufffd\ufffd\ufffd\u000b\u0000\u0004\u0000\u001c\u0000\u0003\u0000N\u0000S\u0000P\u0000l\u0000a\u0000y\u0000e\u0000r\u0000\/\u00009\u0000.\u0000\u0000.\u0000\u0000.\u0002\u00009\u00008\u0000\u0000;\u0000 \u0000{\u0000\u0000\u0000\u0000\u0000A\u0000A\u0000\u0000\u0000-\u0000\u0000A\u0000\u0000\u0000-\u0000\u0000\u0000a\u0000\u0000-\u0000A\u0000A\u0000\u0000A\u0000-\u0000\u0000\u0000", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "kafka probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdMMS\ufffd\ufffd\ufffd\ufffdNSPlayer\/9...98; {AA-A-a-AAA-", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
29/07/2026 22:04:54 UTC	TCP	5001 · UPNP TCP	upnp-tcp	upnp-tcp upnp-tcp · via UPNP TCP:5001 · (sonde / probe)	Faible	Faible · 5
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload GetClassName Pourquoi cette classification : Type « upnp-tcp » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 5 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0532 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GetClassName Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 35, "payload_entropy": 2.8133215876317763, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 5, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0532" ], "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 5 }, "service_name": "upnp-tcp", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2dc99e454e471bf80a96ed9f185f7d6a", "path_pattern_hash": "0dc6bbf1117b9a1ab96b1de856cf3e22" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 5 }, "payload_preview": "\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\fGetClassName\u0000\u0000\u0000\u0002\u0004\u0000\u0000\u0000\u0000\u0001\u0000", "request_sample": "\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\fGetClassName\u0000\u0000\u0000\u0002\u0004\u0000\u0000\u0000\u0000\u0001\u0000", "payload_snippet": "\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\fGetClassName\u0000\u0000\u0000\u0002\u0004\u0000\u0000\u0000\u0000\u0001\u0000", "evidence": { "request_sample": "\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\fGetClassName\u0000\u0000\u0000\u0002\u0004\u0000\u0000\u0000\u0000\u0001\u0000", "payload_snippet": "\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\fGetClassName\u0000\u0000\u0000\u0002\u0004\u0000\u0000\u0000\u0000\u0001\u0000", "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bd6312c8970580f268a9ad620499be0d9949d8ea", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\fGetClassName\u0000\u0000\u0000\u0002\u0004\u0000\u0000\u0000\u0000\u0001\u0000", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "GetClassName", "attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 5 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 5, "risk_label": "Faible", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "pat-0532" ], "tags_summary_labels_fr": [ "pat-0532" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\fGetClassName\u0000\u0000\u0000\u0002\u0004\u0000\u0000\u0000\u0000\u0001\u0000", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "evidence_snippet": "GetClassName", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/07/2026 22:04:50 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Sonde PostgreSQL postgres probe · via UPNP TCP:5001 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload ��\|,��&�nh�Y��dy��{��: "�I��a�<W�QQ��6��5 ,��4̨̩�/�0�+�,� �̨̪3=� 9� ��/5� Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��\|,��&�nh�Y��dy��{��: "�I��a�<W�QQ��6��5,��4̨̩�/�0�+�,� �̨̪3=� 9� ��/5� Requête brute (extrait) ��\|,��&�nh�Y��dy��{��: "�I��a�<W�QQ��6��5 ,��4̨̩�/�0�+�,� �̨̪3=� 9� ��/5�{ �+ 3&$ h1 �jl$,y�b�2�L�)\|��D%�$S Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "bytes_in": 257, "payload_entropy": 5.7563466789043085, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "436278379f11f507398419d513ec805702ed650d", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ee97bf209814fdc7df0550c04ea70022", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\|,\ufffd\ufffd&\ufffdn\u0010h\ufffdY\ufffd\ufffd\ufffd\ufffddy\ufffd\ufffd{\ufffd\ufffd\ufffd\u0016\b\ufffd\ufffd\ufffd\ufffd\u0016: \"\ufffdI\u0007\ufffd\u000e\u0016\ufffd\ufffd\ufffda\u001b\ufffd<W\ufffdQQ\ufffd\ufffd6\u0016\ufffd\ufffd\ufffd5\u000b,\ufffd\b\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\|,\ufffd\ufffd&\ufffdn\u0010h\ufffdY\ufffd\ufffd\ufffd\ufffddy\ufffd\ufffd{\ufffd\ufffd\ufffd\u0016\b\ufffd\ufffd\ufffd\ufffd\u0016: \"\ufffdI\u0007\ufffd\u000e\u0016\ufffd\ufffd\ufffda\u001b\ufffd<W\ufffdQQ\ufffd\ufffd6\u0016\ufffd\ufffd\ufffd5\u000b,\ufffd\b\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 h1\t\ufffdjl$,y\ufffdb\ufffd2\ufffdL\ufffd)\|\ufffd\ufffd\ufffd\u001b\ufffdD%\u0000\ufffd$\u001eS", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\|,\ufffd\ufffd&\ufffdn\u0010h\ufffdY\ufffd\ufffd\ufffd\ufffddy\ufffd\ufffd{\ufffd\ufffd\ufffd\u0016\b\ufffd\ufffd\ufffd\ufffd\u0016: \"\ufffdI\u0007\ufffd\u000e\u0016\ufffd\ufffd\ufffda\u001b\ufffd<W\ufffdQQ\ufffd\ufffd6\u0016\ufffd\ufffd\ufffd5\u000b,\ufffd\b\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "37240a0f5ec205a402da82851a09eca1960312e0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\|,\ufffd\ufffd&\ufffdn\u0010h\ufffdY\ufffd\ufffd\ufffd\ufffddy\ufffd\ufffd{\ufffd\ufffd\ufffd\u0016\b\ufffd\ufffd\ufffd\ufffd\u0016: \"\ufffdI\u0007\ufffd\u000e\u0016\ufffd\ufffd\ufffda\u001b\ufffd<W\ufffdQQ\ufffd\ufffd6\u0016\ufffd\ufffd\ufffd5\u000b,\ufffd\b\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "evidence_snippet": "\ufffd\ufffd\|,\ufffd\ufffd&\ufffdnh\ufffdY\ufffd\ufffd\ufffd\ufffddy\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd: \"\ufffdI\ufffd\ufffd\ufffd\ufffda\ufffd<W\ufffdQQ\ufffd\ufffd6\ufffd\ufffd\ufffd5,\ufffd\ufffd\ufffd4\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\ufffd\u0328\u032a3=\ufffd\n9\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd", "attack_vector": "postgres probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\|,\ufffd\ufffd&\ufffdn\u0010h\ufffdY\ufffd\ufffd\ufffd\ufffddy\ufffd\ufffd{\ufffd\ufffd\ufffd\u0016\b\ufffd\ufffd\ufffd\ufffd\u0016: \"\ufffdI\u0007\ufffd\u000e\u0016\ufffd\ufffd\ufffda\u001b\ufffd<W\ufffdQQ\ufffd\ufffd6\u0016\ufffd\ufffd\ufffd5\u000b,\ufffd\b\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "postgres probe \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\|,\ufffd\ufffd&\ufffdnh\ufffdY\ufffd\ufffd\ufffd\ufffddy\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd: \"\ufffdI\ufffd\ufffd\ufffd\ufffda\ufffd<W\ufffdQQ\ufffd\ufffd6\ufffd\ufffd\ufffd5,\ufffd\ufffd\ufffd4\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\ufffd\u0328\u032a3=\ufffd\n9\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
29/07/2026 22:04:50 UTC	TCP	5001 · UPNP TCP	upnp-tcp	upnp-tcp upnp-tcp · via UPNP TCP:5001 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Pourquoi cette classification : Type « upnp-tcp » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a", "emulator_response_len": 39, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "upnp-tcp", "app_proto": "upnp-tcp", "asn": 135377, "country": "US", "dst_port": 5001, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.6, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3", "event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720", "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "upnp-tcp", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "0dc6bbf1117b9a1ab96b1de856cf3e22" }, "target_context": { "dst_port": 5001, "service": "upnp-tcp", "service_name": "upnp-tcp", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0dcb90c621fcb924b8f5810b858cb3662262766d", "protocol_details": { "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "upnp-tcp", "service_label_fr": "UPNP TCP", "dst_port": 5001, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-upnp-tcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 5001, "service": "upnp-tcp", "service_label_fr": "UPNP TCP" }, "attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "5001 \u00b7 UPNP TCP", "emulator_service": "upnp-tcp", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "upnp_tcp", "service_banner": "honeypot-upnp-tcp", "service_os": "linux", "dst_port": "5001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/07/2026 10:44:26 UTC	TCP	10082 · HTTP	http	Cross-site scripting xss attack · via HTTP:10082 · (tentative d'exploit) · → /robots.txt	Élevée	Faible · 39
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /robots.txt UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /robots.txt TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10082 Chemin / cible /robots.txt Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 39 Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET /robots.txt HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /robots.txt HTTP/1.1 Host: 62.3.50.33:10082 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /robots.txt HTTP/1.1 Host: 62.3.50.33:10082 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "txt", "http_ua_hash": "f300f0d9f4416780169520dddfc4974562a97a64", "http_host_hash": "296da129c3505bcfff0b629e7e704c58208908be", "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 431, "payload_entropy": 5.514104709562108, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "http", "app_proto": "http", "asn": 135377, "country": "US", "dst_port": 10082, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 39, "tag_count": 2, "anomaly_count": 0, "campaign_key": "8d1ab7b82c8e5227000d81eeca31c1dad0587a50", "event_fingerprint": "c4a49578c11ac07195910a97f3c23b29770f48ca", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 39, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1fd66a2f6f02ef8323e37dd4d2c2d8c7", "payload_hash": "8e6c05835d441592ff87d7755ec9a498", "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4" }, "target_context": { "dst_port": 10082, "service": "http", "service_name": "http", "risk_score": 39 }, "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "method": "GET", "path": "\/robots.txt", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/robots.txt HTTP\/1.1", "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9", "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "evidence": { "method": "GET", "path": "\/robots.txt", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/robots.txt HTTP\/1.1", "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9", "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9b6fcc77007d0a765be0ac94dbfe754766aaf02a", "protocol_details": { "http_method": "GET", "http_path": "\/robots.txt", "request_line": "GET \/robots.txt HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 10082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "attack_vector": "xss attack \u00b7 via HTTP:10082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt", "target_port_label": "10082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 39, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 39, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10082, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/robots.txt", "request_line": "GET \/robots.txt HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 10082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt", "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "target_port_label": "10082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10082", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
29/07/2026 10:44:26 UTC	TCP	10082 · HTTP	http	Cross-site scripting xss attack · via HTTP:10082 · (tentative d'exploit) · → /sitemap.xml	Élevée	Faible · 39
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /sitemap.xml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /sitemap.xml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10082 Chemin / cible /sitemap.xml Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 39 Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET /sitemap.xml HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /sitemap.xml HTTP/1.1 Host: 62.3.50.33:10082 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3 Requête brute (extrait) GET /sitemap.xml HTTP/1.1 Host: 62.3.50.33:10082 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0. Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "xml", "http_ua_hash": "f300f0d9f4416780169520dddfc4974562a97a64", "http_host_hash": "296da129c3505bcfff0b629e7e704c58208908be", "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 432, "payload_entropy": 5.502003275233775, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "http", "app_proto": "http", "asn": 135377, "country": "US", "dst_port": 10082, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 39, "tag_count": 2, "anomaly_count": 0, "campaign_key": "8d1ab7b82c8e5227000d81eeca31c1dad0587a50", "event_fingerprint": "74355caa38088eb7d6eba80eaccd96bf18b3a747", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 39, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1fd66a2f6f02ef8323e37dd4d2c2d8c7", "payload_hash": "38b2cc1538361798621ed823fb14deb3", "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf" }, "target_context": { "dst_port": 10082, "service": "http", "service_name": "http", "risk_score": 39 }, "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "method": "GET", "path": "\/sitemap.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/sitemap.xml HTTP\/1.1", "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.", "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "evidence": { "method": "GET", "path": "\/sitemap.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/sitemap.xml HTTP\/1.1", "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.", "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f6ced642f09d0d5dbc6ec8e9f50d530c851c097d", "protocol_details": { "http_method": "GET", "http_path": "\/sitemap.xml", "request_line": "GET \/sitemap.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 10082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "attack_vector": "xss attack \u00b7 via HTTP:10082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sitemap.xml", "target_port_label": "10082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 39, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 39, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10082, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/sitemap.xml", "request_line": "GET \/sitemap.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 10082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sitemap.xml", "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "target_port_label": "10082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10082", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
29/07/2026 10:44:25 UTC	TCP	10082 · HTTP	http	SSRF interne ssrf internal · via HTTP:10082 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10082 Chemin / cible / Service HTTP Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54% Confiance classification 62% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:10082 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 User-Agent: Mozilla/5. Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:10082 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Meta JSON brut { "http_header_count": 3, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "f300f0d9f4416780169520dddfc4974562a97a64", "http_host_hash": "296da129c3505bcfff0b629e7e704c58208908be", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 253, "payload_entropy": 5.492713713025034, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "http", "app_proto": "http", "asn": 135377, "country": "US", "dst_port": 10082, "risk_waf": 72, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 72, "classification": 80, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8ab064c76aa918fb90447af9c5c84dce886fe4fd", "event_fingerprint": "65122eee572809f02add2e3bf18b822b09415c2e", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 64, "precision_signals": [ "CRS-920350" ], "kb_rule_ids": [ "CRS-920350" ], "matched_patterns": [ "pat-0324" ], "matched_pattern_names": [ "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 80, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "ssrf_attack", "service_name": "http", "risk_confidence_factor": 54, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1fd66a2f6f02ef8323e37dd4d2c2d8c7", "payload_hash": "5ebd32cc9c8fa8744a5e9904661a01e8", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 10082, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "56642434d8a6e0bd217897f63aeba29bc21fa61a", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 10082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.", "attack_vector": "ssrf internal \u00b7 via HTTP:10082 \u00b7 (tentative d'exploit)", "target_port_label": "10082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 62, "confidence_breakdown": { "waf": 72, "classification": 80, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10082, "protocol_emulated": null, "tags_summary": [ "CRS-920350" ], "tags_summary_labels_fr": [ "CRS-920350" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 10082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf internal \u00b7 via HTTP:10082 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.", "target_port_label": "10082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10082", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
29/07/2026 10:44:25 UTC	TCP	10082 · HTTP	http	Cross-site scripting xss attack · via HTTP:10082 · (tentative d'exploit) · → /favicon.ico	Élevée	Faible · 39
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10082 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 39 Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:10082 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.3 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:10082 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0. Meta JSON brut { "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "f300f0d9f4416780169520dddfc4974562a97a64", "http_host_hash": "296da129c3505bcfff0b629e7e704c58208908be", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 432, "payload_entropy": 5.505831097696343, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "http", "app_proto": "http", "asn": 135377, "country": "US", "dst_port": 10082, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 39, "tag_count": 2, "anomaly_count": 0, "campaign_key": "8d1ab7b82c8e5227000d81eeca31c1dad0587a50", "event_fingerprint": "415fe34da98a38f88d680fc8bbfd1b6e71a46d9c", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 39, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1fd66a2f6f02ef8323e37dd4d2c2d8c7", "payload_hash": "17362a24caba4951e101866160d7cf69", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 10082, "service": "http", "service_name": "http", "risk_score": 39 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4c0b3d9297d86dcd11afa35f4be4aaf8351b29c2", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 10082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "attack_vector": "xss attack \u00b7 via HTTP:10082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "target_port_label": "10082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 39, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 39, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10082, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 10082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:10082 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10082\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.3", "target_port_label": "10082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "http", "port:10082", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ], "behavior_alert_count": 1, "behavior_priority": 96 }
29/07/2026 10:44:22 UTC	TCP	10082	—	Sonde port Sonde port · port 10082 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10082 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": null, "app_proto": null, "asn": 135377, "country": "US", "dst_port": 10082, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "76ffcf32e8f193a1fb1f9bf528b9dbbd8fc48a6f", "event_fingerprint": "73773a37febd7f59a41cf18e5d1a30ac37874edb", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 10082, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c0bbe6e194e696dd377e838f1b9fa922d1fa68ac", "protocol_details": { "port": 10082 }, "attack_vector": "Sonde port \u00b7 port 10082 \u00b7 (sonde \/ probe)", "target_port_label": "10082", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 10082, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "port": 10082 }, "attack_vector": "Sonde port \u00b7 port 10082 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "10082", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "10082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:10082", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/07/2026 10:44:21 UTC	TCP	10082 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:10082 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 3429560be8f9b1b5 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10082 Chemin / cible — Service TLS Payload ��TKPk�Q�=�6� ��v`ۏ��l�:м��} �ѣ��N%V��+>�7�'�6F���8��4̨̩�/�0�+�,� �̨̪3=� 9� ��/5� Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��TKPk�Q�=�6� ��v`ۏ��l�:м��} �ѣ��N%V��+>�7�'�6F���8��4̨̩�/�0�+�,� �̨̪3=� 9� ��/5� Requête brute (extrait) ��TKPk�Q�=�6� ��v`ۏ��l�:м��} �ѣ��N%V��+>�7�'�6F���8��4̨̩�/�0�+�,� �̨̪3=� 9� ��/5�{ �+ 3&$ �M�ژ�<}�0G20��{�9 �I�VV�AT� 2H Meta JSON brut { "tls_ja3_hash": "3429560be8f9b1b5aa346694eb419bad", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 8, "bytes_in": 257, "payload_entropy": 5.828827816668982, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "tls", "app_proto": "tls", "asn": 135377, "country": "US", "dst_port": 10082, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d48c84a187a72b433f210aff40f3168ffb566814", "event_fingerprint": "6dc9a5d9df7d600ce07858fe416583695681bddc", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "3429560be8f9b1b5aa346694eb419bad", "payload_hash": "e8e04c243c9a961ee08954fcd3500561", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 10082, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003TKPk\ufffdQ\ufffd=\ufffd6\ufffd\r\ufffd\ufffd\ufffdv\u001b`\u06cf\ufffd\ufffdl\ufffd:\u0013\u0001\u043c\ufffd\ufffd} \ufffd\u0463\ufffd\ufffdN%V\ufffd\ufffd\ufffd+>\ufffd\u00017\u0013\ufffd\u0017\u0002'\u000e\ufffd6F\ufffd\ufffd\ufffd8\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003TKPk\ufffdQ\ufffd=\ufffd6\ufffd\r\ufffd\ufffd\ufffdv\u001b`\u06cf\ufffd\ufffdl\ufffd:\u0013\u0001\u043c\ufffd\ufffd} \ufffd\u0463\ufffd\ufffdN%V\ufffd\ufffd\ufffd+>\ufffd\u00017\u0013\ufffd\u0017\u0002'\u000e\ufffd6F\ufffd\ufffd\ufffd8\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdM\ufffd\u0698\ufffd<}\ufffd0G20\ufffd\ufffd{\ufffd9\r\ufffdI\ufffdVV\ufffdAT\ufffd\n2H", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003TKPk\ufffdQ\ufffd=\ufffd6\ufffd\r\ufffd\ufffd\ufffdv\u001b`\u06cf\ufffd\ufffdl\ufffd:\u0013\u0001\u043c\ufffd\ufffd} \ufffd\u0463\ufffd\ufffdN%V\ufffd\ufffd\ufffd+>\ufffd\u00017\u0013\ufffd\u0017\u0002'\u000e\ufffd6F\ufffd\ufffd\ufffd8\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a2f2a1b64837e35e60a6f8629465728e8c52f864", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003TKPk\ufffdQ\ufffd=\ufffd6\ufffd\r\ufffd\ufffd\ufffdv\u001b`\u06cf\ufffd\ufffdl\ufffd:\u0013\u0001\u043c\ufffd\ufffd} \ufffd\u0463\ufffd\ufffdN%V\ufffd\ufffd\ufffd+>\ufffd\u00017\u0013\ufffd\u0017\u0002'\u000e\ufffd6F\ufffd\ufffd\ufffd8\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "tls_ja3": "3429560be8f9b1b5aa346694eb419bad", "port": 10082, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdTKPk\ufffdQ\ufffd=\ufffd6\ufffd\r\ufffd\ufffd\ufffdv`\u06cf\ufffd\ufffdl\ufffd:\u043c\ufffd\ufffd} \ufffd\u0463\ufffd\ufffdN%V\ufffd\ufffd\ufffd+>\ufffd7\ufffd'\ufffd6F\ufffd\ufffd\ufffd8\ufffd\ufffd4\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\ufffd\u0328\u032a3=\ufffd\n9\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:10082 \u00b7 (sonde \/ probe)", "target_port_label": "10082 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 10082, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003TKPk\ufffdQ\ufffd=\ufffd6\ufffd\r\ufffd\ufffd\ufffdv\u001b`\u06cf\ufffd\ufffdl\ufffd:\u0013\u0001\u043c\ufffd\ufffd} \ufffd\u0463\ufffd\ufffdN%V\ufffd\ufffd\ufffd+>\ufffd\u00017\u0013\ufffd\u0017\u0002'\u000e\ufffd6F\ufffd\ufffd\ufffd8\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "tls_ja3": "3429560be8f9b1b5aa346694eb419bad", "port": 10082, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:10082 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdTKPk\ufffdQ\ufffd=\ufffd6\ufffd\r\ufffd\ufffd\ufffdv`\u06cf\ufffd\ufffdl\ufffd:\u043c\ufffd\ufffd} \ufffd\u0463\ufffd\ufffdN%V\ufffd\ufffd\ufffd+>\ufffd7\ufffd'\ufffd6F\ufffd*\ufffd\ufffd8\ufffd\ufffd4\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\ufffd\u0328\u032a3=\ufffd\n9\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd", "target_port_label": "10082 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "10082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
18/07/2026 02:58:33 UTC	TCP	7005 · HTTP	http	SSRF interne ssrf internal · via HTTP:7005 · (tentative d'exploit)	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7005 Chemin / cible / Service HTTP Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54% Confiance classification 62% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7005 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 User-Agent: Mozilla/5.0 Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7005 Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "f300f0d9f4416780169520dddfc4974562a97a64", "http_host_hash": "d00fa2bfc8544182906dbf6bd8b8736513cb80e8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 252, "payload_entropy": 5.484566597869996, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "http", "app_proto": "http", "asn": 135377, "country": "US", "dst_port": 7005, "risk_waf": 72, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 72, "classification": 80, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "00b6be4dc64c380db1885c6a85ebba05dd85af5f", "event_fingerprint": "00ae45ce628982d2b6e5b5a8a986df5ee0450d69", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "confidence": 0.62, "classification_confidence": 0.62, "precision_score": 64, "precision_signals": [ "CRS-920350" ], "kb_rule_ids": [ "CRS-920350" ], "matched_patterns": [ "pat-0324" ], "matched_pattern_names": [ "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 80, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "ssrf_attack", "service_name": "http", "risk_confidence_factor": 54, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1fd66a2f6f02ef8323e37dd4d2c2d8c7", "payload_hash": "6bda9043b3de3e8336ee8dd4bdb67743", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7005, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "864fd2c8a44455142b3784b7cfb79940c1ef6335", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "attack_vector": "ssrf internal \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit)", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 62, "confidence_breakdown": { "waf": 72, "classification": 80, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7005, "protocol_emulated": true, "tags_summary": [ "CRS-920350" ], "tags_summary_labels_fr": [ "CRS-920350" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf internal \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\r\nUser-Agent: Mozilla\/5.0", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "weblogic-cluster" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
18/07/2026 02:58:33 UTC	TCP	7005 · HTTP	http	Cross-site scripting xss attack · via HTTP:7005 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /favicon.ico UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7005 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:7005 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:7005 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "f300f0d9f4416780169520dddfc4974562a97a64", "http_host_hash": "d00fa2bfc8544182906dbf6bd8b8736513cb80e8", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 431, "payload_entropy": 5.500381817002091, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "http", "app_proto": "http", "asn": 135377, "country": "US", "dst_port": 7005, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7ae8aab44967bf31b8a9830c9897ded781a5741a", "event_fingerprint": "77321c93079d56fec44d8e5fa1d2d1adda84d3fe", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1fd66a2f6f02ef8323e37dd4d2c2d8c7", "payload_hash": "b17fbf85213c49eea79661109d5384fd", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 7005, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a823aaf17014dcbf3c186db61e8cf263a494447", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "attack_vector": "xss attack \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7005, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "weblogic-cluster" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
18/07/2026 02:58:33 UTC	TCP	7005 · HTTP	http	Cross-site scripting xss attack · via HTTP:7005 · (tentative d'exploit) · → /robots.txt	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /robots.txt UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /robots.txt TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7005 Chemin / cible /robots.txt Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET /robots.txt HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /robots.txt HTTP/1.1 Host: 62.3.50.33:7005 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /robots.txt HTTP/1.1 Host: 62.3.50.33:7005 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9, Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e0d0a436f6e74656e742d4c656e6774683a2032340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a557365722d6167656e743a202a0a446973616c6c6f77", "emulator_response_len": 130, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "txt", "http_ua_hash": "f300f0d9f4416780169520dddfc4974562a97a64", "http_host_hash": "d00fa2bfc8544182906dbf6bd8b8736513cb80e8", "http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 430, "payload_entropy": 5.508669781552626, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "http", "app_proto": "http", "asn": 135377, "country": "US", "dst_port": 7005, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7ae8aab44967bf31b8a9830c9897ded781a5741a", "event_fingerprint": "17405b8cfbffa8cff3b4422e6fea42a2200b1169", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1fd66a2f6f02ef8323e37dd4d2c2d8c7", "payload_hash": "771c7313f2357ddc78aa16433cb5c749", "path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4" }, "target_context": { "dst_port": 7005, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 ", "method": "GET", "path": "\/robots.txt", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/robots.txt HTTP\/1.1", "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,", "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "evidence": { "method": "GET", "path": "\/robots.txt", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/robots.txt HTTP\/1.1", "request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,", "payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4664292b858dadd4c56e63c2e00b92cf4da2e7ad", "protocol_details": { "http_method": "GET", "http_path": "\/robots.txt", "request_line": "GET \/robots.txt HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "attack_vector": "xss attack \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7005, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/robots.txt", "request_line": "GET \/robots.txt HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/robots.txt", "evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "weblogic-cluster" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ] }
18/07/2026 02:58:33 UTC	TCP	7005 · HTTP	http	Cross-site scripting xss attack · via HTTP:7005 · (tentative d'exploit) · → /sitemap.xml	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /sitemap.xml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /sitemap.xml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7005 Chemin / cible /sitemap.xml Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET /sitemap.xml HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /sitemap.xml HTTP/1.1 Host: 62.3.50.33:7005 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Requête brute (extrait) GET /sitemap.xml HTTP/1.1 Host: 62.3.50.33:7005 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203130370d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d2231", "emulator_response_len": 219, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "xml", "http_ua_hash": "f300f0d9f4416780169520dddfc4974562a97a64", "http_host_hash": "d00fa2bfc8544182906dbf6bd8b8736513cb80e8", "http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 431, "payload_entropy": 5.49654511328091, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "http", "app_proto": "http", "asn": 135377, "country": "US", "dst_port": 7005, "risk_waf": 60, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7ae8aab44967bf31b8a9830c9897ded781a5741a", "event_fingerprint": "78a897d6d29130514686cb4b04ab00ee47f26629", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1fd66a2f6f02ef8323e37dd4d2c2d8c7", "payload_hash": "6b6807b5d6cf8694089e48368685438f", "path_pattern_hash": "7efd2a819481844ebcfd47a818831daf" }, "target_context": { "dst_port": 7005, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "method": "GET", "path": "\/sitemap.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/sitemap.xml HTTP\/1.1", "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9", "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "evidence": { "method": "GET", "path": "\/sitemap.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/sitemap.xml HTTP\/1.1", "request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 Edg\/120.0.0.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9", "payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "70ecfc3087b8745fc85f89dd80f5c51952cecaf7", "protocol_details": { "http_method": "GET", "http_path": "\/sitemap.xml", "request_line": "GET \/sitemap.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "attack_vector": "xss attack \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sitemap.xml", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 60, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7005, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/sitemap.xml", "request_line": "GET \/sitemap.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/120.0.0.0 Safari\/537.36 E\u2026", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sitemap.xml", "evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "weblogic-cluster" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "net_web_probe" ] }
18/07/2026 02:58:33 UTC	TCP	7005 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:7005 · (tentative d'exploit) · → /config.json	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /config.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.… Émulateur HTTP WAF 13 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_web_probe Cible HTTP GET /config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7005 Chemin / cible /config.json Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive pat-0247 Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Probe /config.json Ligne de requête `GET /config.json HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /config.json HTTP/1.1 Host: 62.3.50.33:7005 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 Requête brute (extrait) GET /config.json HTTP/1.1 Host: 62.3.50.33:7005 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,i Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "32c9dc8a12cee52b4f621c8d1055e8d1d41f3e08", "http_host_hash": "d00fa2bfc8544182906dbf6bd8b8736513cb80e8", "http_target_hash": "110dc2bb220538a9df6ea13fd8474a5056c773dc", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 418, "payload_entropy": 5.524062205848636, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "http", "app_proto": "http", "asn": 135377, "country": "US", "dst_port": 7005, "risk_waf": 60, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 60, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7bb1ce29d7b7c146cf8dcb41eff08825b13c3322", "event_fingerprint": "953fa6a3f1df7950fb66008aa1131bcdd26b4e9e", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 182, "precision_signals": [ "INT-http_sensitive", "pat-0247", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "pat-0247", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284", "pat-0247" ], "matched_pattern_names": [ "CRS 941130", "Probe \/config.json" ], "pattern_ids": [ "pat-0284", "pat-0247" ], "confidence_breakdown": { "waf": 60, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "110ee15c35a0e58fd1b3020e8c43366d", "payload_hash": "4fad533dbb94d447c58292a360842fd2", "path_pattern_hash": "b2ebf86a95e6e198c8d34ea73388c4ce" }, "target_context": { "dst_port": 7005, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11 ", "method": "GET", "path": "\/config.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11 (KHTML, like Gecko) Chrome\/17.0.963.56 Safari\/535.11", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/config.json HTTP\/1.1", "request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11 (KHTML, like Gecko) Chrome\/17.0.963.56 Safari\/535.11\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,i", "payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11", "evidence": { "method": "GET", "path": "\/config.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11 (KHTML, like Gecko) Chrome\/17.0.963.56 Safari\/535.11", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/config.json HTTP\/1.1", "request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11 (KHTML, like Gecko) Chrome\/17.0.963.56 Safari\/535.11\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,i", "payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c6dad457e669d3e48041ddde80299d44f2feb324", "protocol_details": { "http_method": "GET", "http_path": "\/config.json", "request_line": "GET \/config.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11 (KHTML, like Gecko) Chrome\/17.0.963.56 Safari\/535.11", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11", "attack_vector": "config file probe \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 60, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7005, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "pat-0247", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "pat-0247", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/config.json", "request_line": "GET \/config.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11 (KHTML, like Gecko) Chrome\/17.0.963.56 Safari\/535.11", "port": 7005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:7005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json", "evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:7005\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit\/535.11", "target_port_label": "7005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "weblogic-cluster" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "http_sensitive_path", "net_web_probe" ] }
18/07/2026 02:58:28 UTC	TCP	7005 · WEBLOGIC CLUSTER	weblogic-cluster	Sonde PostgreSQL postgres probe · via WEBLOGIC CLUSTER:7005 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBLOGIC-CLUSTER WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7005 Chemin / cible — Service WEBLOGIC CLUSTER Payload ��~�%e=�n%[N{��٘�I��3� \|#��kÛ��OO��q�o�ި<�5!�ŰB��4̨̩�/�0�+�,� �̨̪3=� 9� ��/5� Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��~�%e=�n%[N{��٘�I��3� \|#��kÛ��OO��q�o�ި<�5!�ŰB��4̨̩�/�0�+�,� �̨̪3=� 9� ��/5� Requête brute (extrait) ��~�%e=�n%[N{��٘�I��3� \|#��kÛ��OO��q�o�ި<�5!�ŰB��4̨̩�/�0�+�,� �̨̪3=� 9� ��/5�{ �+ 3&$ ��K3��=�5��4uWiF%FA2 �$�2w Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 257, "payload_entropy": 5.8249752718046555, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "weblogic-cluster", "app_proto": "weblogic-cluster", "asn": 135377, "country": "US", "dst_port": 7005, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "f8101eb0f6f3067273070483bd72d0ae0e7d38cc", "event_fingerprint": "934bb19f48fcc1a73548d901a4f927f2d2b12ed6", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "weblogic-cluster", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "de3c364148310437e8dc2f0bf08c2d6d", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 7005, "service": "weblogic-cluster", "service_name": "weblogic-cluster", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd~\ufffd%e=\ufffdn%[N\u0010{\ufffd\ufffd\u001e\ufffd\u000f\ufffd\u0658\ufffdI\ufffd\ufffd\u0084\ufffd3\ufffd\u0001 \|#\ufffd\ufffd\u0005k\u00db\ufffd\ufffdOO\ufffd\ufffd\ufffdq\ufffdo\ufffd\u07a8\u001e<\ufffd5!\ufffd\u0170B\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd~\ufffd%e=\ufffdn%[N\u0010{\ufffd\ufffd\u001e\ufffd\u000f\ufffd\u0658\ufffdI\ufffd\ufffd\u0084\ufffd3\ufffd\u0001 \|#\ufffd\ufffd\u0005k\u00db\ufffd\ufffdOO\ufffd\ufffd\ufffdq\ufffdo\ufffd\u07a8\u001e<\ufffd5!\ufffd\u0170B\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u001e\ufffdK3\ufffd\ufffd=\u0019\ufffd5\ufffd\ufffd4uWiF%\u001aFA2\t\ufffd$\ufffd\u00072w", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd~\ufffd%e=\ufffdn%[N\u0010{\ufffd\ufffd\u001e\ufffd\u000f\ufffd\u0658\ufffdI\ufffd\ufffd\u0084\ufffd3\ufffd\u0001 \|#\ufffd\ufffd\u0005k\u00db\ufffd\ufffdOO\ufffd\ufffd\ufffdq\ufffdo\ufffd\u07a8\u001e<\ufffd5!\ufffd\u0170B\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2b3730fdce66e7409a00872b40ce953ba0cb20fd", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd~\ufffd%e=\ufffdn%[N\u0010{\ufffd\ufffd\u001e\ufffd\u000f\ufffd\u0658\ufffdI\ufffd\ufffd\u0084\ufffd3\ufffd\u0001 \|#\ufffd\ufffd\u0005k\u00db\ufffd\ufffdOO\ufffd\ufffd\ufffdq\ufffdo\ufffd\u07a8\u001e<\ufffd5!\ufffd\u0170B\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "port": 7005, "service": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd~\ufffd%e=\ufffdn%[N{\ufffd\ufffd\ufffd\ufffd\u0658\ufffdI\ufffd\ufffd\u0084\ufffd3\ufffd \|#\ufffd\ufffdk\u00db\ufffd\ufffdOO\ufffd\ufffd\ufffdq\ufffdo\ufffd\u07a8<\ufffd5!\ufffd\u0170B\ufffd\ufffd4\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\ufffd\u0328\u032a3=\ufffd\n9\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd", "attack_vector": "postgres probe \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)", "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER", "emulator_service": "weblogic-cluster", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER", "dst_port": 7005, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-weblogic-cluster", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd~\ufffd%e=\ufffdn%[N\u0010{\ufffd\ufffd\u001e\ufffd\u000f\ufffd\u0658\ufffdI\ufffd\ufffd\u0084\ufffd3\ufffd\u0001 \|#\ufffd\ufffd\u0005k\u00db\ufffd\ufffdOO\ufffd\ufffd\ufffdq\ufffdo\ufffd\u07a8\u001e<\ufffd5!\ufffd\u0170B\ufffd\ufffd\u00004\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\u0000\ufffd\u0328\u032a\u00003\u0000=\u0000\u0016\ufffd\n\u00009\ufffd\u0013\u0000\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0013\u0003\u0013\u0001", "port": 7005, "service": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER" }, "attack_vector": "postgres probe \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd~\ufffd%e=\ufffdn%[N{\ufffd\ufffd\ufffd\ufffd\u0658\ufffdI\ufffd\ufffd\u0084\ufffd3\ufffd \|#\ufffd\ufffdk\u00db\ufffd\ufffdOO\ufffd\ufffd\ufffdq\ufffdo\ufffd\u07a8<\ufffd5!\ufffd\u0170B\ufffd\ufffd4\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\t\ufffd\u0328\u032a3=\ufffd\n9\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd", "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER", "emulator_service": "weblogic-cluster", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "weblogic_cluster", "service_banner": "honeypot-weblogic-cluster", "service_os": "linux", "dst_port": "7005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
18/07/2026 02:58:28 UTC	TCP	7005 · WEBLOGIC CLUSTER	weblogic-cluster	Sonde WebLogic weblogic-cluster · via WEBLOGIC CLUSTER:7005 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur WEBLOGIC-CLUSTER WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7005 Chemin / cible — Service WEBLOGIC CLUSTER Pourquoi cette classification : Type « weblogic-cluster » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "service": "weblogic-cluster", "app_proto": "weblogic-cluster", "asn": 135377, "country": "US", "dst_port": 7005, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "83c51de1b233c28df4216ed091df6aefa103d293", "event_fingerprint": "934bb19f48fcc1a73548d901a4f927f2d2b12ed6", "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "weblogic-cluster", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 135377, "org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "e2ce115b1271132f0461184d375e8d24" }, "target_context": { "dst_port": 7005, "service": "weblogic-cluster", "service_name": "weblogic-cluster", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c2d7647940e0baf0c1a198c1bf73ea35e6e46630", "protocol_details": { "port": 7005, "service": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER" }, "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)", "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER", "emulator_service": "weblogic-cluster", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab weblogic-cluster \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER", "dst_port": 7005, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-weblogic-cluster", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 7005, "service": "weblogic-cluster", "service_label_fr": "WEBLOGIC CLUSTER" }, "attack_vector": "weblogic-cluster \u00b7 via WEBLOGIC CLUSTER:7005 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7005 \u00b7 WEBLOGIC CLUSTER", "emulator_service": "weblogic-cluster", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "weblogic_cluster", "service_banner": "honeypot-weblogic-cluster", "service_os": "linux", "dst_port": "7005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }

152.32.183.209

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence