|
|
TCP |
8087 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8087 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Go-http-client/1.1
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_ua_suspicious
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8087
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 20 · 1 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8087
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 96,
"payload_entropy": 4.9471234442917975,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 8087,
"risk_waf": 20,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4a09a85bb7f75bb10a34217df02820dce786be9e",
"event_fingerprint": "1f896c380dcb22d4820eb20cfe185729e3a2631d",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "422961ac85bdee8cdcc76fdeebc4baa6",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
},
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "49f6f4635c9c1baae2bba8e0003ea0690a7a19c2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_ua_suspicious",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8087 · HTTP ALT 8087
|
http-alt-8087
|
Sonde PostgreSQL
postgres probe · via HTTP ALT 8087:8087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
HTTP-ALT-8087
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8087
Chemin / cible
—
Service
HTTP ALT 8087
Payload
� ��Qft��e@��Y*A �y*�cEG�J�L�~ �^��!pFǑ��P�!�F�D��ȃc[� X/' &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Qft��e@��Y*A �y*�cEG�J�L�~ �^��!pFǑ��P�!�F�D��ȃc[� X/' &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� ��Qft��e@��Y*A �y*�cEG�J�L�~ �^��!pFǑ��P�!�F�D��ȃc[� X/' &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ �+�!K��G����d�n(�, �� @Ao
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 243,
"payload_entropy": 5.744925697430502,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http-alt-8087",
"app_proto": "http-alt-8087",
"asn": 14061,
"country": "US",
"dst_port": 8087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6bed61276ef96c6ef94adbda5e67e7b39322189a",
"event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http-alt-8087",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "09f4126c3506195f1fd291429d8d88b4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8087,
"service": "http-alt-8087",
"service_name": "http-alt-8087",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd+\ufffd!\u001bK\ufffd\u001a\ufffdG\ufffd\u0011\ufffd\ufffd\u0004\ufffd\u0006d\ufffdn(\ufffd,\u001d\ufffd\ufffd\u000b@Ao",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "14cf50dd12eb1ffd687df984338139987571d2f3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"evidence_snippet": "\ufffd\ufffd\ufffdQft\ufffd\ufffde@\ufffd\ufffdY*A\ufffdy*\ufffdcEG\ufffdJ\ufffdL\ufffd~ \ufffd^\ufffd\ufffd!pF\u01d1\ufffd\ufffdP\ufffd!\ufffdF\ufffdD\ufffd\ufffd\u0203c[\ufffdX\/'&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8087",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffdQft\ufffd\ufffde@\ufffd\ufffdY\u001b\b*A\u001f\ufffd\by*\ufffdcEG\ufffd\u0001J\ufffdL\ufffd~ \ufffd^\ufffd\ufffd\u0014!pF\u01d1\ufffd\ufffdP\ufffd!\ufffd\u0011F\ufffdD\ufffd\ufffd\u0203c[\u0010\ufffd\u001dX\/'\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdQft\ufffd\ufffde@\ufffd\ufffdY*A\ufffdy*\ufffdcEG\ufffdJ\ufffdL\ufffd~ \ufffd^\ufffd\ufffd!pF\u01d1\ufffd\ufffdP\ufffd!\ufffdF\ufffdD\ufffd\ufffd\u0203c[\ufffdX\/'&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8087",
"service_banner": "honeypot-http-alt-8087",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8087 · HTTP ALT 8087
|
http-alt-8087
|
Sonde PostgreSQL
postgres probe · via HTTP ALT 8087:8087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
HTTP-ALT-8087
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8087
Chemin / cible
—
Service
HTTP ALT 8087
Payload
� �����p�v'9,۟ �Or�BqG�X�C9��� E��[c:D�6�Z#�����#��u�2�W &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����p�v'9,۟ �Or�BqG�X�C9��� E��[c:D�6�Z#�����#��u�2�W &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� �����p�v'9,۟ �Or�BqG�X�C9��� E��[c:D�6�Z#�����#��u�2�W &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ �o�`��] ��Ͷ��N�;�U)���or�$�_�,
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 243,
"payload_entropy": 5.855063484799006,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http-alt-8087",
"app_proto": "http-alt-8087",
"asn": 14061,
"country": "US",
"dst_port": 8087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6bed61276ef96c6ef94adbda5e67e7b39322189a",
"event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http-alt-8087",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fa168f9c63d9073aa93cfc4cf35e8adf",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8087,
"service": "http-alt-8087",
"service_name": "http-alt-8087",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdo\ufffd`\ufffd\ufffd]\u001f\ufffd\ufffd\u0376\u0006\ufffd\ufffdN\ufffd;\ufffdU)\ufffd\ufffd\ufffdor\ufffd$\ufffd_\ufffd,",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84341a0c92824ba6bf92effacfbeb1f1535263d3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdBqG\ufffdX\ufffdC9\ufffd\ufffd\ufffd E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd2\ufffdW&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8087",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdB\u0017qG\ufffdX\u0002\ufffdC9\ufffd\ufffd\ufffd\u001a E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd\u00062\ufffdW\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdp\ufffdv'9,\u06df \ufffdOr\ufffdBqG\ufffdX\ufffdC9\ufffd\ufffd\ufffd E\ufffd\ufffd[c:D\ud9f3\udc23\ufffd6\ufffdZ#\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\ufffdu\ufffd2\ufffdW&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8087",
"service_banner": "honeypot-http-alt-8087",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8087 · HTTP
|
http
|
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via HTTP:8087 · (sonde / probe) · → /query
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /query UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
net_sap_diag_probe
Cible HTTP
GET
/query
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8087
Chemin / cible
/query
Pourquoi cette classification : Type « sap_diag_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1
Host: 62.3.50.33:8087
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "148d0a7b9fa867b9eb3d978e0caa495e68940f78",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 116,
"payload_entropy": 5.282838815191514,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 8087,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 24,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "f1306cb307216c62e27854f8b14410432fc2b808",
"event_fingerprint": "c7775fd013fcc70465962bab3d5b9426b1eefc73",
"classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 24,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "f765137bbb37749025ec0175d3b22884",
"path_pattern_hash": "645c82d3be5cca3e8520101eb38681a7"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 24
},
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/query",
"query_string": "q=SHOW+DIAGNOSTICS",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1",
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/query",
"query_string": "q=SHOW+DIAGNOSTICS",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1",
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37ea594da07c39c28b88ccec80a4c5b30fb476fa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/query",
"request_line": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/query",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 24,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/query",
"request_line": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via HTTP:8087 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/query",
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious",
"net_sap_diag_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
8087 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8087 · (tentative d'exploit) · → /cgi-bin/authLogin.cgi
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/authLogin.cgi UA Go-http-client/1.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_probe_cgi_bin
http_sensitive_path
http_ua_suspicious
Cible HTTP
GET
/cgi-bin/authLogin.cgi
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8087
Chemin / cible
/cgi-bin/authLogin.cgi
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /cgi-bin/authLogin.cgi HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /cgi-bin/authLogin.cgi HTTP/1.1
Host: 62.3.50.33:8087
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "8add963f0e61f10c41c8eee4caf504d0e863a0b6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 113,
"payload_entropy": 4.960487291614645,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 8087,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "92d7c5fca0a67e5c41d3032f0b91136b4ac0ecc9",
"event_fingerprint": "98a09d93e83ababbc2155c7ec01f1d0290693339",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "727ed3a4dd8cf7c513fe674850d2a21e",
"path_pattern_hash": "45fb04fbc0c9ee592196ecdb80f81814"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/authLogin.cgi",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/authLogin.cgi",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c6d98bdc9c54494f08c19a9d5abd7be3d97154fc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/authLogin.cgi",
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/authLogin.cgi",
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_ua_suspicious",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8087 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8087 · (tentative d'exploit)
|
Élevée
|
Élevé · 65
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8087
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 50 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8087
User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Accept: */*
Accep
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8087 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "033dedd926f028341b5d0b4ba132f8088c552b7c",
"http_host_hash": "23dd08f746fb09fb08372c318f4fc3071fcf4424",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 148,
"payload_entropy": 5.1417076098349215,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 8087,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.1,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "aed5c6c3a69b40f51fe0dfc5098f618f0323a45e",
"event_fingerprint": "031aed62a5a8e5a86ed0fe82cd5b21d371f071b8",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f9c7ebc5d6f6c8d69ee2392fa6e3a4f",
"payload_hash": "e5bfe4f2df422756ac837a1dddace26b",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f89caf8e0ef16a3a206ada3b0d1645d2929232f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"attack_vector": "ssrf attack \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8087 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8087\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
8087 · HTTP ALT 8087
|
http-alt-8087
|
Sonde PostgreSQL
postgres probe · via HTTP ALT 8087:8087 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
HTTP-ALT-8087
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8087
Chemin / cible
—
Service
HTTP ALT 8087
Payload
� ��X��,�W�� 7w��b��<�-�rE~����� �U �P�� �w���22 -+�2��r�J�E\s� &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��X��,�W�� 7w��b��<�-�rE~����� �U �P�� �w���22 -+�2��r�J�E\s� &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� ��X��,�W�� 7w��b��<�-�rE~����� �U �P�� �w���22 -+�2��r�J�E\s� &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ ��}W��lQ��bIAq.p�p� M�Q�`��)
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 243,
"payload_entropy": 5.838841351013588,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http-alt-8087",
"app_proto": "http-alt-8087",
"asn": 14061,
"country": "US",
"dst_port": 8087,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6bed61276ef96c6ef94adbda5e67e7b39322189a",
"event_fingerprint": "dbdfef249c4070a0f49f9fa3d8dfdd97da9f4af0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http-alt-8087",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e6af83f28c00e30c29839b7bbae90b27",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8087,
"service": "http-alt-8087",
"service_name": "http-alt-8087",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd}W\ufffd\u05f5\ufffdl\u0007Q\ufffd\ufffdbIAq.p\ufffdp\ufffd\u001fM\u0015\ufffdQ\ufffd`\ufffd\ufffd)",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4d94dcbb9abc0e0a0862fc7192bf033a9dfed27c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"evidence_snippet": "\ufffd\ufffd\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffdrE~\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdU\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\ufffd22-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8087",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd\u000b7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffd\u0012rE~\ufffd\u0005\ufffd\ufffd\ufffd\ufffd \u000b\ufffdU\u001c\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\u001b\ufffd22\u001d-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 8087,
"service": "http-alt-8087",
"service_label_fr": "HTTP ALT 8087"
},
"attack_vector": "postgres probe \u00b7 via HTTP ALT 8087:8087 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdX\ufffd\ufffd,\ufffdW\ufffd\ufffd7w\ufffd\ufffdb\ufffd\ufffd<\ufffd-\ufffdrE~\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdU\ufffdP\ufffd\ufffd\t\ufffdw\ufffd\ufffd\ufffd22-+\ufffd2\ufffd\ufffdr\ufffdJ\ufffdE\\s\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "8087 \u00b7 HTTP ALT 8087",
"emulator_service": "http-alt-8087",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8087",
"service_banner": "honeypot-http-alt-8087",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8087"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9202 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:9202 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c216e752cae6f875
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9202
Chemin / cible
—
Service
TLS
Payload
$ ���+)��]l��o���dd�-�A� Y;x� � OuX�)��nDž�砬�"<�Uk��]�V� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
$ ���+)��]l��o���dd�-�A� Y;x� � OuX�)��nDž�砬�"<�Uk��]�V� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
$ ���+)��]l��o���dd�-�A� Y;x� � OuX�)��nDž�砬�"<�Uk��]�V� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � � # * ( + -
Meta JSON brut
{
"tls_ja3_hash": "c216e752cae6f8755fd27f561d031636",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 297,
"payload_entropy": 5.746628977525633,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 14061,
"country": "US",
"dst_port": 9202,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ed8cd28c83fa5a7119f6d02bbe9b15f05e20143a",
"event_fingerprint": "380814499cfaf25125d4df5d0994125324925ad7",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c216e752cae6f8755fd27f561d031636",
"payload_hash": "82a5ec0ae58e6a32b987e910025ebb4a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 9202,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "57bcb3fdb2fce8bb3d680a99398b39e0b0a3b8a2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c216e752cae6f8755fd27f561d031636",
"port": 9202,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "$ \ufffd\ufffd\ufffd+)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffddd\ufffd-\ufffdA\ufffdY;x\ufffd \ufffdOuX\ufffd)\ufffd\ufffdn\u01c5\ufffd\u782c\ufffd\"<\ufffdUk\ufffd\ufffd]\ufffdV\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:9202 \u00b7 (sonde \/ probe)",
"target_port_label": "9202 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9202,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffd\ufffd+\u001b)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffd\u0018dd\ufffd-\ufffdA\ufffd\fY;\u0015x\ufffd\u0007\u001a \ufffd\u001eOuX\ufffd)\ufffd\u0006\ufffdn\u0006\u01c5\ufffd\u782c\ufffd\"\u0011<\ufffdU\u0001k\ufffd\ufffd]\ufffdV\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c216e752cae6f8755fd27f561d031636",
"port": 9202,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:9202 \u00b7 (sonde \/ probe)",
"evidence_snippet": "$ \ufffd\ufffd\ufffd+)\ufffd\ufffd]l\ufffd\ufffdo\ufffd\ufffd\ufffddd\ufffd-\ufffdA\ufffdY;x\ufffd \ufffdOuX\ufffd)\ufffd\ufffdn\u01c5\ufffd\u782c\ufffd\"<\ufffdUk\ufffd\ufffd]\ufffdV\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "9202 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9202"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9202 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:9202 · (tentative d'exploit) · → /v2/_catalog
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /v2/_catalog UA Go-http-client/1.1
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
http_probe_registry
http_ua_suspicious
Cible HTTP
GET
/v2/_catalog
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9202
Chemin / cible
/v2/_catalog
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 52
Confiance : Confiance 59 % — 2 tag(s) WAF
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /v2/_catalog HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
GET /v2/_catalog HTTP/1.1
Host: 62.3.50.33:9202
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "6e8c2e8656fc13dd6ead1c36834052efec40ef08",
"http_target_hash": "0a123e4bf77be2af9aa43488b1d007835b4ab56c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 4.933165189162168,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 9202,
"risk_waf": 64,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "650a9e6509fd0e464317329280945b16aa8d8a17",
"event_fingerprint": "9e8751a1384b706b2edf06f2c10263922c86e152",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "919078819394abd13f660956df7e5394",
"path_pattern_hash": "e619279e9365734b3a57aa3a63edbea8"
},
"target_context": {
"dst_port": 9202,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "21424d6fdb156bb918094c6a79c909f19c8d62f2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9202,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "lfi path traversal \u00b7 via HTTP:9202 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"target_port_label": "9202 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9202,
"protocol_emulated": null,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 9202,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:9202 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:9202\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9202 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9202"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"http_probe_registry",
"http_ua_suspicious"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
10086 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:10086 · (tentative d'exploit) · → /solr/admin/cores
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/cores UA Go-http-client/1.1
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950325:rce-0
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
Cible HTTP
GET
/solr/admin/cores
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10086
Chemin / cible
/solr/admin/cores
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
Host: 62.3.50.33:10086
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 2,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "94eee6682281767a650397a64731a1855e069a99",
"http_target_hash": "6b03df1c77d35ae8990130ccd8ec9b9323ec38c0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.0776944799500745,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 10086,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 54,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "4d7d16c94f763788c12a317a9407a27b7af18d63",
"event_fingerprint": "17e01246ff0e8de53d474532e7bb539ce6dffdbe",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 54
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "7c451a55434cc9b0608075edaeff4e5f",
"path_pattern_hash": "0897b296d8a40895c8b3be949b5c73f5"
},
"target_context": {
"dst_port": 10086,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r",
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "085e3f207a885f3ece08972248f7c585aa0bbf81",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10086,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:10086 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"target_port_label": "10086 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10086,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10086,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:10086 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "10086 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10086"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
10086 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:10086 · (tentative d'exploit) · → /solr/admin/info/system
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/info/system UA Go-http-client/1.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
http_probe_solr
Cible HTTP
GET
/solr/admin/info/system
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10086
Chemin / cible
/solr/admin/info/system
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/info/system HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /solr/admin/info/system HTTP/1.1
Host: 62.3.50.33:10086
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "94eee6682281767a650397a64731a1855e069a99",
"http_target_hash": "fc0e9dcca87dcc3e0fb0c7105f0dc0965b093249",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 115,
"payload_entropy": 4.949304783454331,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 10086,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "4d7de05e81fe671d2700501707fec26480c17e05",
"event_fingerprint": "7e46dca0a2750763c031746568006d9876c68dc7",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "88ab3461190d8ad4e91a1279dcf01cf3",
"path_pattern_hash": "2bb5950eb761b3b523d8b3a4a96c284e"
},
"target_context": {
"dst_port": 10086,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c16ca236cab25f34e2afc0d1a34a1bd0ef9cb42",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10086,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:10086 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"target_port_label": "10086 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10086,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10086,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:10086 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:10086\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "10086 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10086"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
http_get_probe
net_sap_diag_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 116,
"payload_entropy": 5.3000801945018585,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 14061,
"country": "US",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 24,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "16de334ba5aa8d79c6e5150a30d409df9f3db3ca",
"event_fingerprint": "8a81a5f736b7db5d7944a448b5169fde2e93c5a4",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a3d9d5b43a66fa7661d6ec760de74bb2",
"path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 24
},
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ccc791bd1359931cff92c3a50c8a1745d6abeb76",
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"http_get_probe",
"net_sap_diag_probe",
"sap_diag_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
Sonde PostgreSQL
postgres probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
net_couchdb_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
� �8dY\D�W����yCw�~��ƌr�2�� F ����&o�p��� ��B9k<_�z�cۣ�m4 &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �8dY\D�W����yCw�~��ƌr�2�� F
����&o�p��� ��B9k<_�z�cۣ�m4 &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� �8dY\D�W����yCw�~��ƌr�2�� F ����&o�p��� ��B9k<_�z�cۣ�m4 &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ I�����1 _+� �%�ȑ����w�����Y��!
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 243,
"payload_entropy": 5.806882035792383,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 14061,
"country": "US",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2a6ad211f73352e00bbd648921c2250031621d4a",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "130ede751c4a85c99c44ad06247fa5e7",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 I\ufffd\ufffd\ufffd\ufffd\ufffd1\u001c\u001f_+\ufffd\u0000\ufffd%\ufffd\u0211\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd!",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "52ef0b095cb9b5ead48970b26a25fa56a1d553ea",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "\ufffd\ufffd8dY\\D\ufffdW\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00038dY\\D\ufffdW\u0005\u0004\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\u001a\u0011\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\u0015\ufffd\ufffd\u001c\u0006\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd8dY\\D\ufffdW\ufffd\u07bb\ufffd\ufffd\ufffdyCw\ufffd~\ufffd\ufffd\u018cr\ufffd2\ufffd\ufffd F\r\ufffd\ufffd\ufffd\ufffd&o\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffdB9k<_\ufffdz\ufffdc\u06e3\ufffdm4&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"net_couchdb_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
http_get_probe
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: */* Accep
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Accept: */*
Accep
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 148,
"payload_entropy": 5.1552211233484355,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 14061,
"country": "US",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 34,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "cd4aa24d616b8c8c9fdc7b65c18cba1fa792652c",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e65d85b200ab99fe1b990d4ac1a17f07",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0b6579a325840b28904fef6de7c152bebd350498",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"http_get_probe",
"mozi_pattern",
"net_couchdb_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
http_get_probe
net_couchdb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 92,
"payload_entropy": 4.87892518064,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 14061,
"country": "US",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b9cfd159ba211c85f74ecb49bfdc67c2c17a2f04",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c30a9cf5c8189e00696a39e7a75c648c",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07a1586fb76cdd05ff8cbbc5b595c09c2ce63b8a",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"http_get_probe",
"net_couchdb_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
imap bruteforce
imap bruteforce · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Moyen · 41
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1110
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
http_get_probe
imap_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /cgi-bin/authLogin.cgi HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « imap_bruteforce » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 41
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Email Imap Login
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /cgi-bin/authLogin.cgi HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 113,
"payload_entropy": 4.978186406658893,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 14061,
"country": "US",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 66,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 41,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ff5df85c211d5d3903035b95f6de1ea630b4065b",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 76,
"precision_signals": [
"INT-EMAIL-imap-login"
],
"kb_rule_ids": [
"INT-EMAIL-imap-login"
],
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "215f62e8119229cec87d502e99c0877b",
"path_pattern_hash": "d01bbf3f52d5029936b2dffb0f5e856f"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 41
},
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1110"
],
"mitre": "T1110",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "260144661f702231c649eb4a0b055f735b2e5f3a",
"protocol_details": {
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "imap bruteforce \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab imap_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 66,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 41
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 41,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-EMAIL-imap-login"
],
"tags_summary_labels_fr": [
"Email Imap Login"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1110",
"mitre_technique": "T1110",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "imap bruteforce \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"http_get_probe",
"imap_probe",
"net_couchdb_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
Sonde PostgreSQL
postgres probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
net_couchdb_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
� ���KO���u~ CQ�>ՠw6���x����A ��� �'�1C�5�φ�]�)uw� {�O1��ZA &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���KO���u~ CQ�>ՠw6���x����A ��� �'�1C�5�φ�]�)uw�
{�O1��ZA
&�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� ���KO���u~ CQ�>ՠw6���x����A ��� �'�1C�5�φ�]�)uw� {�O1��ZA &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ ��˴u���}�ͻ3h&�\����& � �Y
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 243,
"payload_entropy": 5.722519727754709,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 14061,
"country": "US",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2a6ad211f73352e00bbd648921c2250031621d4a",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b7a2f3bd84a28e4e0559cf51cfc9e367",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u001a\u02f4u\ufffd\ufffd\ufffd}\ufffd\u037b3h&\ufffd\\\ufffd\b\ufffd\ufffd\ufffd&\u001f\ufffd\t\u0017\ufffd\u000fY",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7bdf3cf3066e718e5ea7bc8f6ba1e105a027c8e2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdKO\ufffd\ufffd\ufffdu~CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd \ufffd'\ufffd1C\ufffd5\ufffd\u03c6\ufffd]\ufffd)uw\ufffd\n{\ufffdO1\ufffd\ufffdZA\r&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdK\u0003O\ufffd\ufffd\ufffdu~\u0000CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\u000b\ufffd\ufffd\ufffd \u0000\ufffd\u000e'\ufffd1C\ufffd5\ufffd\u03c6\ufffd\u0015]\ufffd)uw\ufffd\u0014\n{\ufffdO1\ufffd\ufffdZ\u0010A\r\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdKO\ufffd\ufffd\ufffdu~CQ\ufffd>\u0560w6\ufffd\ufffd\ufffdx\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffd \ufffd'\ufffd1C\ufffd5\ufffd\u03c6\ufffd]\ufffd)uw\ufffd\n{\ufffdO1\ufffd\ufffdZA\r&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"net_couchdb_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Moyen · 48
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1046
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
couchdb_probe
couchdb_rest_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET /_all_dbs HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 48
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Infra Couchdb Db
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /_all_dbs HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 100,
"payload_entropy": 5.018339231412708,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 14061,
"country": "US",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 48,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "eeb24ede3f547bd086820dac13d3da57d36ee8f1",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 87,
"precision_signals": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"kb_rule_ids": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d9f97150d72ee0a95502b15842433048",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 48
},
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "541f8fbe5466b9725e0e1ba53e818b26bd987e46",
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 48
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-couchdb-db",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Infra Couchdb Db",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/_all_dbs HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"couchdb_probe",
"couchdb_rest_probe",
"http_get_probe",
"net_couchdb_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
couchdb probe
couchdb probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
http_get_probe
net_couchdb_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
GET / HTTP/1.1 Host: 62.3.50.33:5984 User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
Pourquoi cette classification : Type « couchdb_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5984
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 96,
"payload_entropy": 4.9679567776251305,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 14061,
"country": "US",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b9cfd159ba211c85f74ecb49bfdc67c2c17a2f04",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "66ccdc6765c5de72ee856e3c8555b6b4",
"path_pattern_hash": "ce747dac2688338e030a6b5f71103175"
},
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b99200811753fe477f22a8381b7e93c3473e64d9",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab couchdb_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "couchdb probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5984\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"http_get_probe",
"net_couchdb_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5984 · COUCHDB
|
couchdb
|
Sonde PostgreSQL
postgres probe · via COUCHDB:5984 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
COUCHDB
WAF
—
Recommandation
Surveiller
Tags
couchdb_emulated
couchdb_payload
net_couchdb_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5984
Chemin / cible
—
Service
COUCHDB
Payload
� ����~�J�ٸ�?���t�;S��]#�X-!~�� � �u�= k���=�w��+���r�S3\� &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����~�J�ٸ�?���t�;S��]#�X-!~�� � �u�= k���=�w��+���r�S3\� &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� ����~�J�ٸ�?���t�;S��]#�X-!~�� � �u�= k���=�w��+���r�S3\� &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ ]��..�(8�%O��4����5�K�� i� Yi(
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a20436f75636844422f332e332e33202845726c616e67204f5450290d0a582d436f75636844422d426f64792d54696d653a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a20313534",
"emulator_response_len": 286,
"bytes_in": 243,
"payload_entropy": 5.793306478990544,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "couchdb",
"app_proto": "couchdb",
"asn": 14061,
"country": "US",
"dst_port": 5984,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2a6ad211f73352e00bbd648921c2250031621d4a",
"event_fingerprint": "ff7d4ab9a5d149e36f724b4980f53d45ea707dff",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "couchdb",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ea6c451f9ce0f09d60311cefb5314ab7",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5984,
"service": "couchdb",
"service_name": "couchdb",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ]\ufffd\ufffd..\ufffd(8\ufffd%O\ufffd\ufffd\u001a4\ufffd\ufffd\ufffd\ufffd5\ufffdK\ufffd\ufffd\u001ei\ufffd\u001fYi(",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3d617b62490ae9391dd653e7f3e5dac8005c21f",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!~\ufffd\ufffd \ufffd\ufffdu\ufffd=k\ufffd\ufffd\ufffd=\ufffdw\ufffd\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "couchdb",
"service_label_fr": "COUCHDB",
"dst_port": 5984,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-couchdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!\u0010~\ufffd\ufffd \ufffd\u0000\u0005\ufffdu\ufffd=\fk\u0013\ufffd\ufffd\ufffd=\ufffdw\ufffd\u0014\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 5984,
"service": "couchdb",
"service_label_fr": "COUCHDB"
},
"attack_vector": "postgres probe \u00b7 via COUCHDB:5984 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffdJ\ufffd\u0678\ufffd?\ufffd\ufffd\ufffdt\ufffd;S\ufffd\ufffd]#\ufffdX-!~\ufffd\ufffd \ufffd\ufffdu\ufffd=k\ufffd\ufffd\ufffd=\ufffdw\ufffd\ufffd+\ufffd\ufffd\ufffdr\ufffdS3\u0383\\\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "5984 \u00b7 COUCHDB",
"emulator_service": "couchdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "couchdb",
"service_banner": "honeypot-couchdb",
"service_os": "linux",
"dst_port": "5984"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"couchdb_emulated",
"couchdb_payload",
"net_couchdb_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
27018 · MONGODB SHARD
|
mongodb-shard
|
mongodb shard probe
mongodb shard probe · via MONGODB SHARD:27018 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MONGODB-SHARD
WAF
—
Recommandation
Surveiller
Tags
mongodb_shard_emulated
mongodb_shard_payload
net_mongodb_shard_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27018
Chemin / cible
—
Service
MONGODB SHARD
Payload
$ ��S?�j��3��0`��hX��=4��-�6UP�� |��ɇg0�J;`t=ɲ < �� oijE�p�. >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « mongodb_shard_probe » (signaux protocolaires) · confiance 64%
Confiance classification
64%
Risque capteur
Moyen
· 45
Confiance : Confiance 64 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
Mongo Shard
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
$ ��S?�j��3��0`��hX��=4��-�6UP�� |��ɇg0�J;`t=ɲ <
�� oijE�p�. >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
$ ��S?�j��3��0`��hX��=4��-�6UP�� |��ɇg0�J;`t=ɲ < �� oijE�p�. >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � � # * ( + -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 297,
"payload_entropy": 5.821682234264164,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mongodb-shard",
"app_proto": "mongodb-shard",
"asn": 14061,
"country": "US",
"dst_port": 27018,
"risk_waf": 8,
"risk_classification": 46,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "643e3aa2f37bd345e541ed726975a5b870d81f15",
"event_fingerprint": "55615ed1096b55cc75e4676979dfeb7757337b99",
"classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 71,
"precision_signals": [
"INT-mongo-shard",
"INT-upstream"
],
"kb_rule_ids": [
"INT-mongo-shard",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0554",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "mongodb-shard",
"risk_confidence_factor": 64,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "50c5761d5992e3319999628ed814c97d",
"path_pattern_hash": "19fbd5bc76140ff01438974534217dd2"
},
"target_context": {
"dst_port": 27018,
"service": "mongodb-shard",
"service_name": "mongodb-shard",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a64d6e96c625177388df05a1a07886a31ac65519",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 27018,
"service": "mongodb-shard",
"service_label_fr": "MONGODB SHARD"
},
"evidence_snippet": "$ \ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd0`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`t=\u0272<\r\ufffd\ufffdoijE\ufffdp\ufffd.>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "mongodb shard probe \u00b7 via MONGODB SHARD:27018 \u00b7 (sonde \/ probe)",
"target_port_label": "27018 \u00b7 MONGODB SHARD",
"emulator_service": "mongodb-shard",
"confidence_reason": "Confiance 64 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
"classification_reason_label_fr": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "mongodb-shard",
"service_label_fr": "MONGODB SHARD",
"dst_port": 27018,
"protocol_emulated": true,
"tags_summary": [
"INT-mongo-shard",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Mongo Shard",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb-shard",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003\ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd\u00060`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`\u001bt=\u0272\u001c\u0012<\r\u0002\ufffd\ufffd\u001eoijE\ufffdp\ufffd.\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 27018,
"service": "mongodb-shard",
"service_label_fr": "MONGODB SHARD"
},
"attack_vector": "mongodb shard probe \u00b7 via MONGODB SHARD:27018 \u00b7 (sonde \/ probe)",
"evidence_snippet": "$ \ufffd\ufffdS?\ufffdj\ufffd\ufffd3\ufffd\ufffd0`\ufffd\ufffdhX\ufffd\ufffd=4\ufffd\ufffd-\ufffd6UP\ufffd\ufffd |\ufffd\ufffd\u0247g0\ufffdJ;`t=\u0272<\r\ufffd\ufffdoijE\ufffdp\ufffd.>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "27018 \u00b7 MONGODB SHARD",
"emulator_service": "mongodb-shard",
"confidence_reason": "Confiance 64 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb_shard",
"service_banner": "honeypot-mongodb-shard",
"service_os": "linux",
"dst_port": "27018"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"mongodb_shard_emulated",
"mongodb_shard_payload",
"net_mongodb_shard_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
27018 · MONGODB SHARD
|
mongodb-shard
|
mongodb shard probe
mongodb shard probe · via MONGODB SHARD:27018 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MONGODB-SHARD
WAF
—
Recommandation
Surveiller
Tags
elastic_probe
http_get_probe
mongodb_shard_emulated
mongodb_shard_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27018
Chemin / cible
—
Service
MONGODB SHARD
Payload
GET /v2/_catalog HTTP/1.1 Host: 62.3.50.33:27018 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « mongodb_shard_probe » (signaux protocolaires) · confiance 64%
Confiance classification
64%
Risque capteur
Moyen
· 45
Confiance : Confiance 64 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
Mongo Shard
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /v2/_catalog HTTP/1.1
Host: 62.3.50.33:27018
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 104,
"payload_entropy": 4.96045829705678,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mongodb-shard",
"app_proto": "mongodb-shard",
"asn": 14061,
"country": "US",
"dst_port": 27018,
"risk_waf": 8,
"risk_classification": 46,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "ed897a3b2d71206b7fbf99245bb007013d0d160a",
"event_fingerprint": "55615ed1096b55cc75e4676979dfeb7757337b99",
"classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 71,
"precision_signals": [
"INT-mongo-shard",
"INT-upstream"
],
"kb_rule_ids": [
"INT-mongo-shard",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "mongodb-shard",
"risk_confidence_factor": 64,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4ad68297f51656a7480300225b6198d4",
"path_pattern_hash": "19fbd5bc76140ff01438974534217dd2"
},
"target_context": {
"dst_port": 27018,
"service": "mongodb-shard",
"service_name": "mongodb-shard",
"risk_score": 45
},
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3da25f1172dc3389a5e3129ea412b35ee401564e",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 27018,
"service": "mongodb-shard",
"service_label_fr": "MONGODB SHARD"
},
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "mongodb shard probe \u00b7 via MONGODB SHARD:27018 \u00b7 (sonde \/ probe)",
"target_port_label": "27018 \u00b7 MONGODB SHARD",
"emulator_service": "mongodb-shard",
"confidence_reason": "Confiance 64 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
"classification_reason_label_fr": "Type \u00ab mongodb_shard_probe \u00bb (signaux protocolaires) \u00b7 confiance 64%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 8,
"classification": 46,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "mongodb-shard",
"service_label_fr": "MONGODB SHARD",
"dst_port": 27018,
"protocol_emulated": true,
"tags_summary": [
"INT-mongo-shard",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Mongo Shard",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb-shard",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 27018,
"service": "mongodb-shard",
"service_label_fr": "MONGODB SHARD"
},
"attack_vector": "mongodb shard probe \u00b7 via MONGODB SHARD:27018 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:27018\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "27018 \u00b7 MONGODB SHARD",
"emulator_service": "mongodb-shard",
"confidence_reason": "Confiance 64 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb_shard",
"service_banner": "honeypot-mongodb-shard",
"service_os": "linux",
"dst_port": "27018"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"elastic_probe",
"http_get_probe",
"mongodb_shard_emulated",
"mongodb_shard_payload",
"net_mongodb_shard_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
27019 · MONGODB CONFIG
|
mongodb-config
|
solr probe
solr probe · via MONGODB CONFIG:27019 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
Émulateur
MONGODB-CONFIG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
solr_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27019
Chemin / cible
—
Service
MONGODB CONFIG
Payload
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1 Host: 62.3.50.33:27019 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « solr_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Faible
· 38
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Console admin Apache Solr
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
Host: 62.3.50.33:27019
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 131,
"payload_entropy": 5.0987241555391085,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mongodb-config",
"app_proto": "mongodb-config",
"asn": 14061,
"country": "US",
"dst_port": 27019,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 32,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 32,
"novelty": 15
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "a60b9deb7a9cbfa1c6e49edfebcc95ee4df6bd37",
"event_fingerprint": "36841e4a8048e5c9be2652fb65ea4640a837374d",
"classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 93,
"precision_signals": [
"INT-SEC-solr-admin",
"INT-upstream"
],
"kb_rule_ids": [
"INT-SEC-solr-admin",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 32,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "mongodb-config",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dcfa397b2f8f28e0927053df700dd53e",
"path_pattern_hash": "1532cf2abc57fe877a1cb39330f129c4"
},
"target_context": {
"dst_port": 27019,
"service": "mongodb-config",
"service_name": "mongodb-config",
"risk_score": 38
},
"payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"monitoring_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "132780e5bff693e44767a26004b1dddccddc8fa5",
"protocol_details": {
"payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 27019,
"service": "mongodb-config",
"service_label_fr": "MONGODB CONFIG"
},
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "solr probe \u00b7 via MONGODB CONFIG:27019 \u00b7 (sonde \/ probe)",
"target_port_label": "27019 \u00b7 MONGODB CONFIG",
"emulator_service": "mongodb-config",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 32,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb-config",
"service_label_fr": "MONGODB CONFIG",
"dst_port": 27019,
"protocol_emulated": true,
"tags_summary": [
"INT-SEC-solr-admin",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Console admin Apache Solr",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb-config",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 27019,
"service": "mongodb-config",
"service_label_fr": "MONGODB CONFIG"
},
"attack_vector": "solr probe \u00b7 via MONGODB CONFIG:27019 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "27019 \u00b7 MONGODB CONFIG",
"emulator_service": "mongodb-config",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb_config",
"service_banner": "honeypot-mongodb-config",
"service_os": "linux",
"dst_port": "27019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"solr_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
27019 · MONGODB CONFIG
|
mongodb-config
|
solr probe
solr probe · via MONGODB CONFIG:27019 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
Émulateur
MONGODB-CONFIG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
solr_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27019
Chemin / cible
—
Service
MONGODB CONFIG
Payload
GET /solr/admin/info/system HTTP/1.1 Host: 62.3.50.33:27019 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « solr_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Faible
· 38
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Console admin Apache Solr
Upstream
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /solr/admin/info/system HTTP/1.1
Host: 62.3.50.33:27019
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 115,
"payload_entropy": 4.973260326951405,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "mongodb-config",
"app_proto": "mongodb-config",
"asn": 14061,
"country": "US",
"dst_port": 27019,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 32,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 32,
"novelty": 15
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "a60b9deb7a9cbfa1c6e49edfebcc95ee4df6bd37",
"event_fingerprint": "36841e4a8048e5c9be2652fb65ea4640a837374d",
"classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 93,
"precision_signals": [
"INT-SEC-solr-admin",
"INT-upstream"
],
"kb_rule_ids": [
"INT-SEC-solr-admin",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 32,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "mongodb-config",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a967f753ea4fb35384ac6c57150ade40",
"path_pattern_hash": "1532cf2abc57fe877a1cb39330f129c4"
},
"target_context": {
"dst_port": 27019,
"service": "mongodb-config",
"service_name": "mongodb-config",
"risk_score": 38
},
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"monitoring_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "941f05456e38cef36a34bf89fb8af1ca4174c9d7",
"protocol_details": {
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 27019,
"service": "mongodb-config",
"service_label_fr": "MONGODB CONFIG"
},
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "solr probe \u00b7 via MONGODB CONFIG:27019 \u00b7 (sonde \/ probe)",
"target_port_label": "27019 \u00b7 MONGODB CONFIG",
"emulator_service": "mongodb-config",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab solr_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 32,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "mongodb-config",
"service_label_fr": "MONGODB CONFIG",
"dst_port": 27019,
"protocol_emulated": true,
"tags_summary": [
"INT-SEC-solr-admin",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Console admin Apache Solr",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb-config",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 27019,
"service": "mongodb-config",
"service_label_fr": "MONGODB CONFIG"
},
"attack_vector": "solr probe \u00b7 via MONGODB CONFIG:27019 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:27019\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "27019 \u00b7 MONGODB CONFIG",
"emulator_service": "mongodb-config",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb_config",
"service_banner": "honeypot-mongodb-config",
"service_os": "linux",
"dst_port": "27019"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"solr_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cat/indices
|
Élevée
|
Moyen · 43
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices?format=json UA Go-http-client/1.1
Émulateur
ELASTICSEARCH
WAF
10
Recommandation
Surveiller
Tags
950468:nosqli-3
950607:elastic-cat
http_probe_elastic
http_ua_suspicious
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Tags WAF: nosqli-3, elastic-cat · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 43
Confiance : Confiance 49 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0342
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES cat indices
Ligne de requête
GET /_cat/indices?format=json HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?format=json HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "370cae99942aa27e42f71117e2dde07013b646f5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 116,
"payload_entropy": 5.034790160917155,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 14061,
"country": "US",
"dst_port": 9200,
"risk_waf": 48,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 48,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "b314e05ccaca9d318cb7e51d317b528fa9c1a295",
"event_fingerprint": "ed23d7883983626253e3ecc0bfe647d76c8ba300",
"classification_reason": "Tags WAF: nosqli-3, elastic-cat \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0342"
],
"kb_rule_ids": [
"pat-0342"
],
"matched_patterns": [
"pat-0342"
],
"matched_pattern_names": [
"ES cat indices"
],
"pattern_ids": [
"pat-0342"
],
"confidence_breakdown": {
"waf": 48,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "ccab3a5526cd63b45db967d3c93802bb",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 43
},
"payload_preview": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Tags WAF: nosqli-3, elastic-cat \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6e2866c0a67a552d1bf2d5a029d7f8b898620276",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3, elastic-cat \u00b7 confiance 49%",
"classification_reason_label_fr": "Tags WAF: nosqli-3, elastic-cat \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 43\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 48,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0342"
],
"tags_summary_labels_fr": [
"pat-0342"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?format=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cat\/indices",
"evidence_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"http_ua_suspicious",
"net_elasticsearch_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
admin panel scan
admin panel scan · via ELASTICSEARCH:9200 · (sonde / probe) · → /solr/admin/info/system
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /solr/admin/info/system Requête Elasticsearch : /solr/admin/info/system UA Go-http-client/1.1
Émulateur
ELASTICSEARCH
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
http_probe_solr
Cible HTTP
GET
/solr/admin/info/system
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9200
Chemin / cible
/solr/admin/info/system
Pourquoi cette classification : Sonde fichier sensible / config · confiance 57%
Confiance classification
57%
Risque capteur
Moyen
· 45
Confiance : Confiance 57 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
pat-0754
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/info/system HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /solr/admin/info/system HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "fc0e9dcca87dcc3e0fb0c7105f0dc0965b093249",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 4.951735055507564,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 14061,
"country": "US",
"dst_port": 9200,
"risk_waf": 32,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 32,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 25
},
"risk_score": 45,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e04f8ec99812a2328029a122ca901143eb01c77e",
"event_fingerprint": "8c33725be688e5224ee30e2588756785a8a34fcd",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 68,
"precision_signals": [
"pat-0754"
],
"kb_rule_ids": [
"pat-0754"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 32,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 25,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 57,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "d79e62f489c6d545fb6da68e22b820c9",
"path_pattern_hash": "2bb5950eb761b3b523d8b3a4a96c284e"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 45
},
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "516f611ee4d0bec98ecdea7306dd7c1e0bcb8670",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/solr\/admin\/info\/system",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "admin panel scan \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/solr\/admin\/info\/system",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 57 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 32,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 25,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0754"
],
"tags_summary_labels_fr": [
"pat-0754"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/solr\/admin\/info\/system",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "admin panel scan \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/solr\/admin\/info\/system",
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 57 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious",
"net_elasticsearch_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET / Requête Elasticsearch : /?pretty UA Go-http-client/1.1
Émulateur
ELASTICSEARCH
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_ua_suspicious
net_elasticsearch_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9200
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 22
Confiance : Confiance 0 % — 1 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /?pretty HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET /?pretty HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "e3801637f4e20ff756436cae7ea6a14f0a14f884",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 99,
"payload_entropy": 4.887418939614036,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 14061,
"country": "US",
"dst_port": 9200,
"risk_waf": 20,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 50,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 20,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f5c706d584f258613df0890f290076064d9813ba",
"event_fingerprint": "098920f5126a62ee13d43b53d4ee5ea90d49db9d",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 20,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 15,
"risk_score": 22
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "c6b58563b4a5cc8147a29b9880fbfa3a",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 22
},
"payload_preview": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/",
"query_string": "pretty",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/?pretty HTTP\/1.1",
"request_sample": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "pretty",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/?pretty HTTP\/1.1",
"request_sample": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f88da7ba230c3d96ff331d4fe6437060b7b9f8d2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/?pretty HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/?pretty",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 0 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%",
"classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 20,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 15,
"risk_score": 22
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 22,
"risk_label": "Faible",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/?pretty HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/?pretty",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 0 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_ua_suspicious",
"net_elasticsearch_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
admin panel scan
admin panel scan · via ELASTICSEARCH:9200 · (sonde / probe) · → /solr/admin/cores
|
Élevée
|
Moyen · 46
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /solr/admin/cores Requête Elasticsearch : /solr/admin/cores?action=STATUS&wt=json UA Go-http-client/1.1
Émulateur
ELASTICSEARCH
WAF
13
Recommandation
Surveiller
Tags
950325:rce-0
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
Cible HTTP
GET
/solr/admin/cores
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9200
Chemin / cible
/solr/admin/cores
Pourquoi cette classification : Sonde fichier sensible / config · confiance 57%
Confiance classification
57%
Risque capteur
Moyen
· 46
Confiance : Confiance 57 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0754
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 2,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "6b03df1c77d35ae8990130ccd8ec9b9323ec38c0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 130,
"payload_entropy": 5.079361691078381,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 14061,
"country": "US",
"dst_port": 9200,
"risk_waf": 60,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 25
},
"risk_score": 46,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "f73f6c2d8a960e3faa52cbed3f4c02e6b4f2f52e",
"event_fingerprint": "c6ed935311cbbd02dbe47f705b1bf1a4eee44197",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 68,
"precision_signals": [
"pat-0754"
],
"kb_rule_ids": [
"pat-0754"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 57,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "adbbf5c94ec0bab6c0ad9b3bf51fbbbc",
"path_pattern_hash": "0897b296d8a40895c8b3be949b5c73f5"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 46
},
"payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n",
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7aedb2f173f47c63d9856f72a85442e36807e4a3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/solr\/admin\/cores?action=STATUS&wt=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "admin panel scan \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/solr\/admin\/cores",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 57 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 57%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 46\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 60,
"classification": 50,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0754"
],
"tags_summary_labels_fr": [
"pat-0754"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/solr\/admin\/cores?action=STATUS&wt=json",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "admin panel scan \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/solr\/admin\/cores",
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 57 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious",
"net_elasticsearch_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe) · → /_cluster/health
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /_cluster/health Requête Elasticsearch : /_cluster/health?pretty UA Go-http-client/1.1
Émulateur
ELASTICSEARCH
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_ua_suspicious
net_elasticsearch_probe
Cible HTTP
GET
/_cluster/health
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9200
Chemin / cible
/_cluster/health
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Protocole émulé
1
Signaux
pat-0343
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
ES cluster health
Ligne de requête
GET /_cluster/health?pretty HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /_cluster/health?pretty HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "53bde7c84dc4dc98126ef993b7b218052b711371",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 4.960903621107942,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 14061,
"country": "US",
"dst_port": 9200,
"risk_waf": 32,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 50,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 32,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "91d2e7506a9875f0debdfdad206687c85bb79c1f",
"event_fingerprint": "d5d9e95d93081a1c53ae48aba60dbed362b00ae8",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 83,
"precision_signals": [
"pat-0343",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0343",
"INT-upstream"
],
"matched_patterns": [
"pat-0343"
],
"matched_pattern_names": [
"ES cluster health"
],
"pattern_ids": [
"pat-0343"
],
"confidence_breakdown": {
"waf": 32,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "b1a301cbc718c2d738afd670ea118454",
"path_pattern_hash": "bf1b7d0b38d26e824261898ee406b457"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 40
},
"payload_preview": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/_cluster\/health",
"query_string": "pretty",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/_cluster\/health?pretty HTTP\/1.1",
"request_sample": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/_cluster\/health",
"query_string": "pretty",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/_cluster\/health?pretty HTTP\/1.1",
"request_sample": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a535efad52c621c96259511ee9be7aef4672b33",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cluster\/health",
"request_line": "GET \/_cluster\/health?pretty HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cluster\/health?pretty",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cluster\/health",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 32,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 50,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0343",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0343",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cluster\/health",
"request_line": "GET \/_cluster\/health?pretty HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cluster\/health?pretty",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/_cluster\/health",
"evidence_snippet": "GET \/_cluster\/health?pretty HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_ua_suspicious",
"net_elasticsearch_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
15671 · RABBITMQ AMQP ALT
|
rabbitmq-amqp-alt
|
amqp probe
amqp probe · via RABBITMQ AMQP ALT:15671 · (sonde / probe)
|
Élevée
|
Moyen · 45
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RABBITMQ-AMQP-ALT
WAF
—
Recommandation
Surveiller
Tags
amqp_emulated
net_amqp_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
15671
Chemin / cible
—
Service
RABBITMQ AMQP ALT
Payload
$ O�;��Y� | \,w�L#�y� H� 2X��� #uI��p�l!�t��.�j�i�]��U����� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « amqp_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
$ O�;��Y� |
\,w�L#�y� H� 2X��� #uI��p�l!�t��.�j�i�]��U����� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
$ O�;��Y� | \,w�L#�y� H� 2X��� #uI��p�l!�t��.�j�i�]��U����� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � � # * ( + -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 297,
"payload_entropy": 5.835542887178731,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "rabbitmq-amqp-alt",
"app_proto": "rabbitmq-amqp-alt",
"asn": 14061,
"country": "US",
"dst_port": 15671,
"risk_waf": 8,
"risk_classification": 43,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "040536fe3395b1b40d1b3ed5518168535b7e9f5f",
"event_fingerprint": "b9f59d3714affe35498245ea9ddd6ed9d5c90042",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"service_name": "rabbitmq-amqp-alt",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6545fb5b899b039921154fbe0643d92f",
"path_pattern_hash": "e0a8a2707ca9342b66a175c0e4383ba0"
},
"target_context": {
"dst_port": 15671,
"service": "rabbitmq-amqp-alt",
"service_name": "rabbitmq-amqp-alt",
"risk_score": 45
},
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d2ef7bd7dc5c543db0b55c5498e51024d29543d2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 15671,
"service": "rabbitmq-amqp-alt",
"service_label_fr": "RABBITMQ AMQP ALT"
},
"evidence_snippet": "$ O\ufffd;\ufffd\ufffdY\ufffd|\r\\,w\ufffdL#\ufffdy\ufffdH\ufffd2X\ufffd\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\ufffd\t>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "amqp probe \u00b7 via RABBITMQ AMQP ALT:15671 \u00b7 (sonde \/ probe)",
"target_port_label": "15671 \u00b7 RABBITMQ AMQP ALT",
"emulator_service": "rabbitmq-amqp-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 43,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "rabbitmq-amqp-alt",
"service_label_fr": "RABBITMQ AMQP ALT",
"dst_port": 15671,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rabbitmq-amqp-alt",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003O\ufffd;\ufffd\ufffdY\ufffd\u001c|\r\\,w\ufffdL#\u0015\ufffdy\ufffd\u001eH\ufffd\u001d2X\u001a\ufffd\u0003\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\u0007\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\t\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"port": 15671,
"service": "rabbitmq-amqp-alt",
"service_label_fr": "RABBITMQ AMQP ALT"
},
"attack_vector": "amqp probe \u00b7 via RABBITMQ AMQP ALT:15671 \u00b7 (sonde \/ probe)",
"evidence_snippet": "$ O\ufffd;\ufffd\ufffdY\ufffd|\r\\,w\ufffdL#\ufffdy\ufffdH\ufffd2X\ufffd\ufffd\ufffd #uI\ufffd\ufffdp\ufffdl!\ufffdt\ufffd\ufffd.\ufffdj\ufffdi\ufffd]\ufffd\ufffdU\ufffd\ufffd\ufffd\ufffd\ufffd\t>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "15671 \u00b7 RABBITMQ AMQP ALT",
"emulator_service": "rabbitmq-amqp-alt",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rabbitmq_amqp_alt",
"service_banner": "honeypot-rabbitmq-amqp-alt",
"service_os": "linux",
"dst_port": "15671"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"rabbitmq-amqp-alt"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"amqp_emulated",
"net_amqp_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
15671 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:15671 · (tentative d'exploit) · → /v2/_catalog
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /v2/_catalog UA Go-http-client/1.1
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
http_probe_registry
http_ua_suspicious
Cible HTTP
GET
/v2/_catalog
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
15671
Chemin / cible
/v2/_catalog
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 52
Confiance : Confiance 59 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /v2/_catalog HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
GET /v2/_catalog HTTP/1.1
Host: 62.3.50.33:15671
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "8601cef8c1a410d202a4b0e031c4e59225bb7c01",
"http_target_hash": "0a123e4bf77be2af9aa43488b1d007835b4ab56c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 4.930215537174793,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 15671,
"risk_waf": 64,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "90129db9effc1b2cb7682f848c90bfc4545fac56",
"event_fingerprint": "86bcf3854dbb3657ebe93567a561cb4d70380cac",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 52
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "dbec8893abf7e903d42a1291d235c53d",
"path_pattern_hash": "e619279e9365734b3a57aa3a63edbea8"
},
"target_context": {
"dst_port": 15671,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "44984ed923ac0a9ce4a6df11143ed7f00d103cc9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 15671,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "lfi path traversal \u00b7 via HTTP:15671 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"target_port_label": "15671 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 15671,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 15671,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:15671 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:15671\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "15671 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "15671"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"http_probe_registry",
"http_ua_suspicious",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
2181 · ZOOKEEPER
|
zookeeper
|
zookeeper
zookeeper · via ZOOKEEPER:2181 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
ZOOKEEPER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2181
Chemin / cible
—
Service
ZOOKEEPER
Payload
srvr
Pourquoi cette classification : Type « zookeeper » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5a6f6f6b65657065722076657273696f6e3a20332e382e332d2d312c206275696c74206f6e20323032332d31302d30352031303a3030205554430d0a",
"emulator_response_len": 60,
"bytes_in": 5,
"payload_entropy": 1.9219280948873623,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "zookeeper",
"app_proto": "zookeeper",
"asn": 14061,
"country": "US",
"dst_port": 2181,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "799665ba2feb5b28e885503d11fc53fcc5d6a97c",
"event_fingerprint": "a14d5f3d8510c5c8ed26794618586d29bf6943c9",
"classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "zookeeper",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6cac8f0a754db2892f30d9e02f68cc10",
"path_pattern_hash": "456831beef3fc1500939995d7369695f"
},
"target_context": {
"dst_port": 2181,
"service": "zookeeper",
"service_name": "zookeeper",
"risk_score": 0
},
"payload_preview": "srvr\n",
"request_sample": "srvr\n",
"payload_snippet": "srvr",
"evidence": {
"request_sample": "srvr\n",
"payload_snippet": "srvr",
"classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a4a8413d8d76163250e4fa9cfe2d68020d904a9a",
"protocol_details": {
"payload_preview": "srvr",
"port": 2181,
"service": "zookeeper",
"service_label_fr": "ZOOKEEPER"
},
"evidence_snippet": "srvr",
"attack_vector": "zookeeper \u00b7 via ZOOKEEPER:2181 \u00b7 (sonde \/ probe)",
"target_port_label": "2181 \u00b7 ZOOKEEPER",
"emulator_service": "zookeeper",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "zookeeper",
"service_label_fr": "ZOOKEEPER",
"dst_port": 2181,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-zookeeper",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "srvr",
"port": 2181,
"service": "zookeeper",
"service_label_fr": "ZOOKEEPER"
},
"attack_vector": "zookeeper \u00b7 via ZOOKEEPER:2181 \u00b7 (sonde \/ probe)",
"evidence_snippet": "srvr",
"target_port_label": "2181 \u00b7 ZOOKEEPER",
"emulator_service": "zookeeper",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "zookeeper",
"service_banner": "honeypot-zookeeper",
"service_os": "linux",
"dst_port": "2181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
2181 · ZOOKEEPER
|
zookeeper
|
zookeeper
zookeeper · via ZOOKEEPER:2181 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
ZOOKEEPER
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2181
Chemin / cible
—
Service
ZOOKEEPER
Payload
cons
Pourquoi cette classification : Type « zookeeper » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "5a6f6f6b65657065722076657273696f6e3a20332e382e332d2d312c206275696c74206f6e20323032332d31302d30352031303a3030205554430d0a",
"emulator_response_len": 60,
"bytes_in": 5,
"payload_entropy": 2.321928094887362,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "zookeeper",
"app_proto": "zookeeper",
"asn": 14061,
"country": "US",
"dst_port": 2181,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "799665ba2feb5b28e885503d11fc53fcc5d6a97c",
"event_fingerprint": "a14d5f3d8510c5c8ed26794618586d29bf6943c9",
"classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "zookeeper",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d40a54d34a106e80e51499bb41f59bc0",
"path_pattern_hash": "456831beef3fc1500939995d7369695f"
},
"target_context": {
"dst_port": 2181,
"service": "zookeeper",
"service_name": "zookeeper",
"risk_score": 0
},
"payload_preview": "cons\n",
"request_sample": "cons\n",
"payload_snippet": "cons",
"evidence": {
"request_sample": "cons\n",
"payload_snippet": "cons",
"classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "37bab6914a8ff0c162be463093b21678960e1a94",
"protocol_details": {
"payload_preview": "cons",
"port": 2181,
"service": "zookeeper",
"service_label_fr": "ZOOKEEPER"
},
"evidence_snippet": "cons",
"attack_vector": "zookeeper \u00b7 via ZOOKEEPER:2181 \u00b7 (sonde \/ probe)",
"target_port_label": "2181 \u00b7 ZOOKEEPER",
"emulator_service": "zookeeper",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "zookeeper",
"service_label_fr": "ZOOKEEPER",
"dst_port": 2181,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-zookeeper",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "cons",
"port": 2181,
"service": "zookeeper",
"service_label_fr": "ZOOKEEPER"
},
"attack_vector": "zookeeper \u00b7 via ZOOKEEPER:2181 \u00b7 (sonde \/ probe)",
"evidence_snippet": "cons",
"target_port_label": "2181 \u00b7 ZOOKEEPER",
"emulator_service": "zookeeper",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "zookeeper",
"service_banner": "honeypot-zookeeper",
"service_os": "linux",
"dst_port": "2181"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
1434 · SAP Diag
|
sap-diag
|
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via SAP Diag:1434 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
net_sap_diag_probe
sap_diag_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1434
Chemin / cible
—
Service
SAP Diag
Payload
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1 Host: 62.3.50.33:1434 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 3 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /query?q=SHOW+DIAGNOSTICS HTTP/1.1
Host: 62.3.50.33:1434
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"bytes_in": 116,
"payload_entropy": 5.24098749646502,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 14061,
"country": "US",
"dst_port": 1434,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 48,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15
},
"risk_score": 24,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "6da1789e0ad45120eece1ff5b4a8249d4c4af3a6",
"event_fingerprint": "40137d96bb752a7247071c548273f04549b28579",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "371d7293bcecad9823da21dfea13a920",
"path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
},
"target_context": {
"dst_port": 1434,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 24
},
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "58582fea6ca2aa696e93838fddeea6c7c1fb718b",
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 1434,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:1434 \u00b7 (sonde \/ probe)",
"target_port_label": "1434 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 15,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 1434,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 1434,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:1434 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/query?q=SHOW+DIAGNOSTICS HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "1434 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "1434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"net_sap_diag_probe",
"sap_diag_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1434 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1434 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1434
Chemin / cible
—
Service
TLS
Payload
� ��a\~��È�a��o^w ���a��:XH=::� r:�X���r�,����je1g(���qB`e� &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��a\~��È�a��o^w ���a��:XH=::� r:�X���r�,����je1g(���qB`e� &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� ��a\~��È�a��o^w ���a��:XH=::� r:�X���r�,����je1g(���qB`e� &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ ��&�F~G�-�~ZJ *��#sa�X�<��50
Meta JSON brut
{
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.786352102033492,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 14061,
"country": "US",
"dst_port": 1434,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2cf103f954c60e81dc10c69c201fcdda5cfa54dc",
"event_fingerprint": "49296f9ac59bf54b662c3e70f4330ed9641e6005",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"payload_hash": "ad2cde9736064676de6c18a82a93a8f9",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1434,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd&\ufffdF~G\ufffd-\ufffd~Z\u0002J\f*\ufffd\ufffd#sa\ufffdX\ufffd<\ufffd\ufffd5\u00150\u001e",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4863c03c35b20e33272f4f5b934b6996214aaefb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 1434,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffda\\~\ufffd\ufffd\u00c8\ufffda\ufffd\ufffdo^w\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd r:\ufffdX\ufffd\ufffd\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g(\ufffd\ufffd\ufffdqB`e\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:1434 \u00b7 (sonde \/ probe)",
"target_port_label": "1434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1434,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffda\\~\ufffd\u0011\u0019\ufffd\u0004\u00c8\ufffda\ufffd\ufffdo^w\u001f\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd \u0013r:\ufffdX\ufffd\ufffd\u001a\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g\u0013(\ufffd\ufffd\ufffd\u0013qB`e\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 1434,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1434 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffda\\~\ufffd\ufffd\u00c8\ufffda\ufffd\ufffdo^w\ufffd\ufffd\ufffda\ufffd\ufffd:XH=::\ufffd r:\ufffdX\ufffd\ufffd\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffdje1g(\ufffd\ufffd\ufffdqB`e\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "1434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"sap-diag",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1434 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:1434 · (tentative d'exploit)
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1434
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:1434
User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Accept: */*
Accep
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:1434 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "033dedd926f028341b5d0b4ba132f8088c552b7c",
"http_host_hash": "20f633e7cff478c2585f58298d013520fa99a95f",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 148,
"payload_entropy": 5.119781174038729,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 1434,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 61,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "882d6aaceef8cddb7a8ced18c6d2a7568bf88dee",
"event_fingerprint": "35c21b2fbdbf24e94c6bd7174d7e7a26a7819e4d",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f9c7ebc5d6f6c8d69ee2392fa6e3a4f",
"payload_hash": "9f67ddd5b940f72bb2e4a9a711121abd",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 1434,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "038c7949fe76020c4973d21e1b372f24f3df7019",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"port": 1434,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"attack_vector": "ssrf attack \u00b7 via HTTP:1434 \u00b7 (tentative d'exploit)",
"target_port_label": "1434 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1434,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"port": 1434,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:1434 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccep",
"target_port_label": "1434 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sap-diag",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
1434 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:1434 · (tentative d'exploit) · → /cgi-bin/authLogin.cgi
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/authLogin.cgi UA Go-http-client/1.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_probe_cgi_bin
http_sensitive_path
http_ua_suspicious
Cible HTTP
GET
/cgi-bin/authLogin.cgi
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1434
Chemin / cible
/cgi-bin/authLogin.cgi
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /cgi-bin/authLogin.cgi HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /cgi-bin/authLogin.cgi HTTP/1.1
Host: 62.3.50.33:1434
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "20f633e7cff478c2585f58298d013520fa99a95f",
"http_target_hash": "8add963f0e61f10c41c8eee4caf504d0e863a0b6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 113,
"payload_entropy": 4.91752487593081,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "US",
"dst_port": 1434,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 46,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d42d5f7a678cd770575e9d7d6d5efbd710d63d22",
"event_fingerprint": "07c5e4f5d149f34e23230554e8d139914d0d8e8a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "686167e783cfa80aa9c6c25399cfa951",
"path_pattern_hash": "45fb04fbc0c9ee592196ecdb80f81814"
},
"target_context": {
"dst_port": 1434,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/authLogin.cgi",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/authLogin.cgi",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e66141593cb48be9f2517752a60d20eb2864b91b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/authLogin.cgi",
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1434,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:1434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
"target_port_label": "1434 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1434,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/authLogin.cgi",
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1434,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:1434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:1434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "1434 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sap-diag",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_ua_suspicious",
"iot_http_endpoint"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
1434 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1434 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 d6828e30ab66774a
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1434
Chemin / cible
—
Service
TLS
Payload
� �l5`nGJMfTUׁ�}j�QO5�LK� P� ;�aQ�MH�+c���[��i�֖Xh3�X�'�# &�+�/�,�0̨̩� �� � � � / 5� {
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �l5`nGJMfTUׁ�}j�QO5�LK� P� ;�aQ�MH�+c���[��i�֖Xh3�X�'�# &�+�/�,�0̨̩� ��
� � � / 5�
{
Requête brute (extrait)
� �l5`nGJMfTUׁ�}j�QO5�LK� P� ;�aQ�MH�+c���[��i�֖Xh3�X�'�# &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ ?��� �݄(���8��}�X�Gt���&�-
Meta JSON brut
{
"tls_ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 243,
"payload_entropy": 5.80020615895438,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 14061,
"country": "US",
"dst_port": 1434,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2cf103f954c60e81dc10c69c201fcdda5cfa54dc",
"event_fingerprint": "49296f9ac59bf54b662c3e70f4330ed9641e6005",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"payload_hash": "830c83a8f5416c51b0c7ded5335b8011",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "e4d60caa902b8b84112358f96af813c3",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0",
"tls_ja4_hash": "e4d60caa902b8b84112358f96af813c3",
"tls_ja4": "t13d0119_0f418b0e79cc_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1434,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000fl\u001b5`nGJMfTU\u0011\u05c1\ufffd}\u0003j\u0007\ufffdQO5\ufffdLK\ufffd P\ufffd ;\u0002\ufffdaQ\ufffdM\u0010H\ufffd+c\ufffd\ufffd\ufffd[\b\ufffd\ufffdi\ufffd\u0596Xh3\ufffdX\ufffd'\ufffd#\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000fl\u001b5`nGJMfTU\u0011\u05c1\ufffd}\u0003j\u0007\ufffdQO5\ufffdLK\ufffd P\ufffd ;\u0002\ufffdaQ\ufffdM\u0010H\ufffd+c\ufffd\ufffd\ufffd[\b\ufffd\ufffdi\ufffd\u0596Xh3\ufffdX\ufffd'\ufffd#\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ?\ufffd\ufffd\ufffd\t\ufffd\u0744(\ufffd\ufffd\ufffd8\ufffd\ufffd\u0018}\ufffdX\ufffdGt\ufffd\ufffd\u0013\ufffd\u001a&\ufffd-",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000fl\u001b5`nGJMfTU\u0011\u05c1\ufffd}\u0003j\u0007\ufffdQO5\ufffdLK\ufffd P\ufffd ;\u0002\ufffdaQ\ufffdM\u0010H\ufffd+c\ufffd\ufffd\ufffd[\b\ufffd\ufffdi\ufffd\u0596Xh3\ufffdX\ufffd'\ufffd#\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e7e138da4f0db51077225cb9bdc3371fae8916a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000fl\u001b5`nGJMfTU\u0011\u05c1\ufffd}\u0003j\u0007\ufffdQO5\ufffdLK\ufffd P\ufffd ;\u0002\ufffdaQ\ufffdM\u0010H\ufffd+c\ufffd\ufffd\ufffd[\b\ufffd\ufffdi\ufffd\u0596Xh3\ufffdX\ufffd'\ufffd#\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 1434,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdl5`nGJMfTU\u05c1\ufffd}j\ufffdQO5\ufffdLK\ufffd P\ufffd ;\ufffdaQ\ufffdMH\ufffd+c\ufffd\ufffd\ufffd[\ufffd\ufffdi\ufffd\u0596Xh3\ufffdX\ufffd'\ufffd#&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"attack_vector": "postgres probe \u00b7 via TLS:1434 \u00b7 (sonde \/ probe)",
"target_port_label": "1434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1434,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000fl\u001b5`nGJMfTU\u0011\u05c1\ufffd}\u0003j\u0007\ufffdQO5\ufffdLK\ufffd P\ufffd ;\u0002\ufffdaQ\ufffdM\u0010H\ufffd+c\ufffd\ufffd\ufffd[\b\ufffd\ufffdi\ufffd\u0596Xh3\ufffdX\ufffd'\ufffd#\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
"tls_ja3": "d6828e30ab66774a91a96ae93be4ae4c",
"tls_ja4": "e4d60caa902b8b84112358f96af813c3",
"port": 1434,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1434 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdl5`nGJMfTU\u05c1\ufffd}j\ufffdQO5\ufffdLK\ufffd P\ufffd ;\ufffdaQ\ufffdMH\ufffd+c\ufffd\ufffd\ufffd[\ufffd\ufffdi\ufffd\u0596Xh3\ufffdX\ufffd'\ufffd#&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{",
"target_port_label": "1434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sap-diag",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1434 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1434 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 1b9bb541fa237aff SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
1434
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� ��-sa"��p��N$�ev�� ��� �*���oqv P�/�+���� �� / 5� �$�#� � � ��(�'̨̩̪ k g 9 3 = < � �,�0
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��-sa"��p��N$�ev�� ��� �*���oqv P�/�+���� ��
/ 5�
�$�#� � � ��(�'̨̩̪ k g 9 3 = < � �,�0
Requête brute (extrait)
� ��-sa"��p��N$�ev�� ��� �*���oqv P�/�+���� �� / 5� �$�#� � � ��(�'̨̩̪ k g 9 3 = < � �,�0 G 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "1b9bb541fa237aff65acf838b154df7f",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 19,
"bytes_in": 201,
"payload_entropy": 5.064983688991275,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 14061,
"country": "US",
"dst_port": 1434,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "55d99cd2a84e9fbd1568d112164906d1f7081172",
"event_fingerprint": "58491be22f60090f89fa72d36482e97c8ea08d9e",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1b9bb541fa237aff65acf838b154df7f",
"payload_hash": "754a36112b05cc10493fce7d7506ab50",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_version": "0x0303",
"tls_cipher_count": 40,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49160-158-157-156-49192-49191-52393-52392-52394-107-103-57-51-22-61-60-4-20-159-21-49196-49200-8-6-3,0-5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_ja4": "t13d0140_c79c1c2c7c3c_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 40,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 1434,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-sa\"\ufffd\ufffdp\ufffd\ufffdN$\ufffdev\ufffd\ufffd\f\ufffd\b\ufffd\ufffd\u001c\ufffd\u0011*\ufffd\ufffd\ufffdoqv\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-sa\"\ufffd\ufffdp\ufffd\ufffdN$\ufffdev\ufffd\ufffd\f\ufffd\b\ufffd\ufffd\u001c\ufffd\u0011*\ufffd\ufffd\ufffdoqv\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000\u0000G\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-sa\"\ufffd\ufffdp\ufffd\ufffdN$\ufffdev\ufffd\ufffd\f\ufffd\b\ufffd\ufffd\u001c\ufffd\u0011*\ufffd\ufffd\ufffdoqv\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa9512b7cdce042b909c856defb0489010d6d0a7",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-sa\"\ufffd\ufffdp\ufffd\ufffdN$\ufffdev\ufffd\ufffd\f\ufffd\b\ufffd\ufffd\u001c\ufffd\u0011*\ufffd\ufffd\ufffdoqv\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"tls_ja3": "1b9bb541fa237aff65acf838b154df7f",
"tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_sni": "62.3.50.33",
"port": 1434,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd-sa\"\ufffd\ufffdp\ufffd\ufffdN$\ufffdev\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdoqvP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0",
"attack_vector": "postgres probe \u00b7 via TLS:1434 \u00b7 (sonde \/ probe)",
"target_port_label": "1434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1434,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd-sa\"\ufffd\ufffdp\ufffd\ufffdN$\ufffdev\ufffd\ufffd\f\ufffd\b\ufffd\ufffd\u001c\ufffd\u0011*\ufffd\ufffd\ufffdoqv\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"tls_ja3": "1b9bb541fa237aff65acf838b154df7f",
"tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_sni": "62.3.50.33",
"port": 1434,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1434 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd-sa\"\ufffd\ufffdp\ufffd\ufffdN$\ufffdev\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffdoqvP\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0",
"target_port_label": "1434 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"sap-diag",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|