|
|
TCP |
1911 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:1911 · (tentative d'exploit) · → /solr/admin/cores
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/cores UA Go-http-client/1.1
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950325:rce-0
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
Cible HTTP
GET
/solr/admin/cores
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1911
Chemin / cible
/solr/admin/cores
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 55
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
Host: 62.3.50.33:1911
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 2,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "45d05ba63edd774e3fb61abe1b40e7927cdf50e7",
"http_target_hash": "6b03df1c77d35ae8990130ccd8ec9b9323ec38c0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 130,
"payload_entropy": 5.041695560676536,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "DE",
"dst_port": 1911,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 55,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "3b4cf6cb8f7525e7af43c22d82313d3c9b0d8d9f",
"event_fingerprint": "ea84bf9de3b26139cb658044890eb0b7d12b424d",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 55
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "167bf50bb5cfbbc7879d19b29a7d5f56",
"path_pattern_hash": "0897b296d8a40895c8b3be949b5c73f5"
},
"target_context": {
"dst_port": 1911,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n",
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "89a92dfccf8d17d5034f71f74d2644de6aca13b7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1911,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:1911 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"target_port_label": "1911 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1911,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1911,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:1911 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "1911 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
1911 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:1911 · (tentative d'exploit) · → /solr/admin/info/system
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/info/system UA Go-http-client/1.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
http_probe_solr
Cible HTTP
GET
/solr/admin/info/system
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1911
Chemin / cible
/solr/admin/info/system
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/info/system HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /solr/admin/info/system HTTP/1.1
Host: 62.3.50.33:1911
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "45d05ba63edd774e3fb61abe1b40e7927cdf50e7",
"http_target_hash": "fc0e9dcca87dcc3e0fb0c7105f0dc0965b093249",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 4.908782450663356,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "DE",
"dst_port": 1911,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "94f5c327ba6c409a0a5322d668a6cd618ee98698",
"event_fingerprint": "9cbe4b4cb7143cd46336afe172d6299e079be7af",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "a9b205d8ee7f870fa9087f47fa2db7bd",
"path_pattern_hash": "2bb5950eb761b3b523d8b3a4a96c284e"
},
"target_context": {
"dst_port": 1911,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d3051789f673fae8ff1e920a7460c5146a5fbc03",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1911,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:1911 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"target_port_label": "1911 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1911,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 1911,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:1911 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:1911\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "1911 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1911"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
11434 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:11434 · (tentative d'exploit) · → /cgi-bin/authLogin.cgi
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/authLogin.cgi UA Go-http-client/1.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_probe_cgi_bin
http_sensitive_path
http_ua_suspicious
Cible HTTP
GET
/cgi-bin/authLogin.cgi
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
11434
Chemin / cible
/cgi-bin/authLogin.cgi
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /cgi-bin/authLogin.cgi HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /cgi-bin/authLogin.cgi HTTP/1.1
Host: 62.3.50.33:11434
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "0edcf6ab7022a3c1a90b1ad0670bd95a56782eca",
"http_target_hash": "8add963f0e61f10c41c8eee4caf504d0e863a0b6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 4.912714169404872,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "DE",
"dst_port": 11434,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "9ba42d169d7e3cce6cc8a215778896618b60f41a",
"event_fingerprint": "fa3fbaea525cd6258216ce466e5a79b154041e7a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "b83a8a362b625e97155ef0e5853dd2cd",
"path_pattern_hash": "45fb04fbc0c9ee592196ecdb80f81814"
},
"target_context": {
"dst_port": 11434,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/cgi-bin\/authLogin.cgi",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/authLogin.cgi",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "690f39feb65c811ea759b0b9f481d84e4bea192f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/authLogin.cgi",
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 11434,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:11434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
"target_port_label": "11434 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11434,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/authLogin.cgi",
"request_line": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 11434,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:11434 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/authLogin.cgi",
"evidence_snippet": "GET \/cgi-bin\/authLogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:11434\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "11434 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_ua_suspicious",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
23 · Telnet
|
telnet
|
Sonde port 23/TCP
port 23 tcp · via Telnet:23 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TELNET
WAF
—
Recommandation
Surveiller
Tags
net_telnet_probe
telnet_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23
Chemin / cible
—
Preuve honeypot — Sonde port 23/TCP
Connexion détectée sur le port 23 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_23_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
"emulator_response_len": 45,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "DigitalOcean, LLC",
"service": "telnet",
"app_proto": "telnet",
"asn": 14061,
"country": "DE",
"dst_port": 23,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ee98e358747c5d752a0eb3d3b34c59d0ffe7f883",
"event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"named_classification_skipped": true,
"named_candidate": "telnet_probe",
"service_name": "telnet",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2bb94c377622e6c9a2e704e9148568af"
},
"target_context": {
"dst_port": 23,
"service": "telnet",
"service_name": "telnet",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "375a927bb9bbd2eb33edd9b4264c0c0b9afc3f8d",
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 36,
"novelty": 0,
"risk_score": 42
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "telnet",
"service_label_fr": "Telnet",
"dst_port": 23,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-telnet",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "telnet",
"service_banner": "honeypot-telnet",
"service_os": "linux",
"dst_port": "23"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_telnet_probe",
"telnet_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Sonde Elasticsearch
elasticsearch probe · via SAP ICM:8000 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
elastic_probe
http_get_probe
net_sap_web_probe
sap_icm_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
GET /v2/_catalog HTTP/1.1 Host: 62.3.50.33:8000 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 56%
Confiance classification
56%
Risque capteur
Faible
· 33
Confiance : Confiance 56 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
Infra Elastic Cat
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /v2/_catalog HTTP/1.1
Host: 62.3.50.33:8000
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 103,
"payload_entropy": 4.933165189162168,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 14061,
"country": "DE",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 25
},
"risk_score": 33,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "0fab6133a9ca720479845372bedaf418c57ab984",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"confidence": 0.56,
"classification_confidence": 0.56,
"precision_score": 66,
"precision_signals": [
"INT-INFRA-elastic-cat"
],
"kb_rule_ids": [
"INT-INFRA-elastic-cat"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 25,
"risk_score": 33
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4787650b209d825a888be5091b9ae7a0",
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 33
},
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 56%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "728bd051b790e231d08363cffb57977a29d27e8f",
"protocol_details": {
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "elasticsearch probe \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 56,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 40,
"protocol": 48,
"novelty": 25,
"risk_score": 33
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"INT-INFRA-elastic-cat"
],
"tags_summary_labels_fr": [
"Infra Elastic Cat"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "elasticsearch probe \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8000\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 56 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"elastic_probe",
"http_get_probe",
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Sonde Kubernetes API
kubernetes probe · via K8S API:6443 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
k8s_api_emulated
k8s_api_payload
kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
GET /api/v1/services HTTP/1.1 Host: 62.3.50.33:6443 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/services HTTP/1.1
Host: 62.3.50.33:6443
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303320466f7262696464656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2038370d0a0d0a7b226b696e64223a22537461747573222c2261706956657273696f6e223a227631222c22737461747573223a224661696c75",
"emulator_response_len": 165,
"bytes_in": 107,
"payload_entropy": 4.898870736560132,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 14061,
"country": "DE",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 24,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "779b413768864c7b9c97862a39322b83a3bf76f5",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "28a04abad4b36b78579447b2b595ff41",
"path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 24
},
"payload_preview": "GET \/api\/v1\/services HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/api\/v1\/services HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/services HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/api\/v1\/services HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/services HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ad0d5425ee55dbe9ba0a33d8ef032d828de7fa6",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/services HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "GET \/api\/v1\/services HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/services HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/api\/v1\/services HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Sonde Kubernetes API
kubernetes probe · via K8S API:6443 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
k8s_api_emulated
k8s_api_payload
kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
GET /api/v1/endpoints HTTP/1.1 Host: 62.3.50.33:6443 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/endpoints HTTP/1.1
Host: 62.3.50.33:6443
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303320466f7262696464656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2038370d0a0d0a7b226b696e64223a22537461747573222c2261706956657273696f6e223a227631222c22737461747573223a224661696c75",
"emulator_response_len": 165,
"bytes_in": 108,
"payload_entropy": 4.893777207971476,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 14061,
"country": "DE",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 24,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "779b413768864c7b9c97862a39322b83a3bf76f5",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2bf0a41cc5979a408c340a9c68e4d6c9",
"path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 24
},
"payload_preview": "GET \/api\/v1\/endpoints HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/api\/v1\/endpoints HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/endpoints HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/api\/v1\/endpoints HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/endpoints HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a65d82023fbfee76d48fdeeb368b2f517872a593",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/endpoints HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "GET \/api\/v1\/endpoints HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/endpoints HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/api\/v1\/endpoints HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Sonde Kubernetes API
kubernetes probe · via K8S API:6443 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
k8s_api_emulated
k8s_api_payload
kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
GET /api/v1/pods HTTP/1.1 Host: 62.3.50.33:6443 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/pods HTTP/1.1
Host: 62.3.50.33:6443
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303320466f7262696464656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2038370d0a0d0a7b226b696e64223a22537461747573222c2261706956657273696f6e223a227631222c22737461747573223a224661696c75",
"emulator_response_len": 165,
"bytes_in": 103,
"payload_entropy": 4.922703329950544,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 14061,
"country": "DE",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 24,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "779b413768864c7b9c97862a39322b83a3bf76f5",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "32f1a6e4e289071a9674b2ba357ab4dc",
"path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 24
},
"payload_preview": "GET \/api\/v1\/pods HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/api\/v1\/pods HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/pods HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/api\/v1\/pods HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/pods HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a74615f3b84f8ff9660a4b6ddf6baf6aa5e60a9",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/pods HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "GET \/api\/v1\/pods HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/pods HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/api\/v1\/pods HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Sonde Kubernetes API
kubernetes probe · via K8S API:6443 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
k8s_api_emulated
k8s_api_payload
kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
GET /api/v1/nodes HTTP/1.1 Host: 62.3.50.33:6443 User-Agent: Go-http-client/1.1 Connection: close
Pourquoi cette classification : Type « kubernetes_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /api/v1/nodes HTTP/1.1
Host: 62.3.50.33:6443
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e312034303320466f7262696464656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2038370d0a0d0a7b226b696e64223a22537461747573222c2261706956657273696f6e223a227631222c22737461747573223a224661696c75",
"emulator_response_len": 165,
"bytes_in": 104,
"payload_entropy": 4.905088825135492,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 14061,
"country": "DE",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 40,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25
},
"risk_score": 24,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "779b413768864c7b9c97862a39322b83a3bf76f5",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2e5e9dff96821ed8fb5f4ccb7b07c615",
"path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 24
},
"payload_preview": "GET \/api\/v1\/nodes HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"request_sample": "GET \/api\/v1\/nodes HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/nodes HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"request_sample": "GET \/api\/v1\/nodes HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/nodes HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cloud_infra_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43df0ce77b2645e4583da385898811596d9b3961",
"protocol_details": {
"payload_preview": "GET \/api\/v1\/nodes HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "GET \/api\/v1\/nodes HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 40,
"protocol": 40,
"novelty": 25,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/api\/v1\/nodes HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/api\/v1\/nodes HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Sonde PostgreSQL
postgres probe · via K8S API:6443 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
k8s_api_emulated
k8s_api_payload
kubernetes_probe
net_kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
l�Z�c`��R��pF�8�� ;{��ٮ�s� �C N!��2 �dEH|� ;���*J�.:Ial�u &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
l�Z�c`��R��pF�8�� ;{��ٮ�s� �C N!��2 �dEH|� ;���*J�.:Ial�u &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
l�Z�c`��R��pF�8�� ;{��ٮ�s� �C N!��2 �dEH|� ;���*J�.:Ial�u &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ i�x�8|���(3 ��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 273,
"payload_entropy": 5.71010475916718,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 14061,
"country": "DE",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25
},
"risk_score": 40,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5f70a73a5934201c2e00970f23615f0b69d2ca8a",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4eb9d0d74c12039c6c48cc1cda6a29b8",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003l\ufffdZ\ufffdc`\ufffd\ufffdR\ufffd\u0002\ufffdpF\u0012\ufffd8\ufffd\u0001\ufffd\u0000;{\ufffd\ufffd\u066e\ufffds\u0011\ufffd \ufffdC N!\ufffd\ufffd2\u001f\ufffddEH|\ufffd\t;\u0002\ufffd\ufffd\ufffd*J\ufffd.:Ial\ufffd\u0017u\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003l\ufffdZ\ufffdc`\ufffd\ufffdR\ufffd\u0002\ufffdpF\u0012\ufffd8\ufffd\u0001\ufffd\u0000;{\ufffd\ufffd\u066e\ufffds\u0011\ufffd \ufffdC N!\ufffd\ufffd2\u001f\ufffddEH|\ufffd\t;\u0002\ufffd\ufffd\ufffd*J\ufffd.:Ial\ufffd\u0017u\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 i\ufffdx\ufffd8|\ufffd\ufffd\ufffd(\u001b3\u0000\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003l\ufffdZ\ufffdc`\ufffd\ufffdR\ufffd\u0002\ufffdpF\u0012\ufffd8\ufffd\u0001\ufffd\u0000;{\ufffd\ufffd\u066e\ufffds\u0011\ufffd \ufffdC N!\ufffd\ufffd2\u001f\ufffddEH|\ufffd\t;\u0002\ufffd\ufffd\ufffd*J\ufffd.:Ial\ufffd\u0017u\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c2efc30ae0362de5b512bb6a380c93d668622d4",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003l\ufffdZ\ufffdc`\ufffd\ufffdR\ufffd\u0002\ufffdpF\u0012\ufffd8\ufffd\u0001\ufffd\u0000;{\ufffd\ufffd\u066e\ufffds\u0011\ufffd \ufffdC N!\ufffd\ufffd2\u001f\ufffddEH|\ufffd\t;\u0002\ufffd\ufffd\ufffd*J\ufffd.:Ial\ufffd\u0017u\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "l\ufffdZ\ufffdc`\ufffd\ufffdR\ufffd\ufffdpF\ufffd8\ufffd\ufffd;{\ufffd\ufffd\u066e\ufffds\ufffd \ufffdC N!\ufffd\ufffd2\ufffddEH|\ufffd\t;\ufffd\ufffd\ufffd*J\ufffd.:Ial\ufffdu&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003l\ufffdZ\ufffdc`\ufffd\ufffdR\ufffd\u0002\ufffdpF\u0012\ufffd8\ufffd\u0001\ufffd\u0000;{\ufffd\ufffd\u066e\ufffds\u0011\ufffd \ufffdC N!\ufffd\ufffd2\u001f\ufffddEH|\ufffd\t;\u0002\ufffd\ufffd\ufffd*J\ufffd.:Ial\ufffd\u0017u\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "postgres probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "l\ufffdZ\ufffdc`\ufffd\ufffdR\ufffd\ufffdpF\ufffd8\ufffd\ufffd;{\ufffd\ufffd\u066e\ufffds\ufffd \ufffdC N!\ufffd\ufffd2\ufffddEH|\ufffd\t;\ufffd\ufffd\ufffd*J\ufffd.:Ial\ufffdu&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Sonde PostgreSQL
postgres probe · via K8S API:6443 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
k8s_api_emulated
k8s_api_payload
kubernetes_probe
net_kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
S9┍�7�;��!ր/���Ed��ח��wg �ٚ�O�4#�� �Ԝ!�)�=�:��m���L� &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
S9┍�7�;��!ր/���Ed��ח��wg �ٚ�O�4#�� �Ԝ!�)�=�:��m���L� &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
S9┍�7�;��!ր/���Ed��ח��wg �ٚ�O�4#�� �Ԝ!�)�=�:��m���L� &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ �l�<�c(<�O����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 273,
"payload_entropy": 5.70555031194867,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 14061,
"country": "DE",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25
},
"risk_score": 40,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5f70a73a5934201c2e00970f23615f0b69d2ca8a",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bc76047c93e8b96ca3f81d4aa003aee9",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u001eS9\u250d\ufffd7\ufffd;\ufffd\ufffd!\u0580\/\ufffd\ufffd\ufffd\u0004\u0002Ed\ufffd\u0014\ufffd\u05d7\ufffd\ufffdwg \u000b\ufffd\u065a\ufffdO\ufffd4#\ufffd\ufffd\u001f\ufffd\u051c!\ufffd)\ufffd=\u0002\ufffd\u0018:\ufffd\ufffdm\ufffd\ufffd\ufffdL\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u001eS9\u250d\ufffd7\ufffd;\ufffd\ufffd!\u0580\/\ufffd\ufffd\ufffd\u0004\u0002Ed\ufffd\u0014\ufffd\u05d7\ufffd\ufffdwg \u000b\ufffd\u065a\ufffdO\ufffd4#\ufffd\ufffd\u001f\ufffd\u051c!\ufffd)\ufffd=\u0002\ufffd\u0018:\ufffd\ufffdm\ufffd\ufffd\ufffdL\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdl\ufffd<\ufffdc\u0016(<\ufffdO\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u001eS9\u250d\ufffd7\ufffd;\ufffd\ufffd!\u0580\/\ufffd\ufffd\ufffd\u0004\u0002Ed\ufffd\u0014\ufffd\u05d7\ufffd\ufffdwg \u000b\ufffd\u065a\ufffdO\ufffd4#\ufffd\ufffd\u001f\ufffd\u051c!\ufffd)\ufffd=\u0002\ufffd\u0018:\ufffd\ufffdm\ufffd\ufffd\ufffdL\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b4989333e1bd2085b2dd5762f7938b573e7da0d8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u001eS9\u250d\ufffd7\ufffd;\ufffd\ufffd!\u0580\/\ufffd\ufffd\ufffd\u0004\u0002Ed\ufffd\u0014\ufffd\u05d7\ufffd\ufffdwg \u000b\ufffd\u065a\ufffdO\ufffd4#\ufffd\ufffd\u001f\ufffd\u051c!\ufffd)\ufffd=\u0002\ufffd\u0018:\ufffd\ufffdm\ufffd\ufffd\ufffdL\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "S9\u250d\ufffd7\ufffd;\ufffd\ufffd!\u0580\/\ufffd\ufffd\ufffdEd\ufffd\ufffd\u05d7\ufffd\ufffdwg \ufffd\u065a\ufffdO\ufffd4#\ufffd\ufffd\ufffd\u051c!\ufffd)\ufffd=\ufffd:\ufffd\ufffdm\ufffd\ufffd\ufffdL\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u001eS9\u250d\ufffd7\ufffd;\ufffd\ufffd!\u0580\/\ufffd\ufffd\ufffd\u0004\u0002Ed\ufffd\u0014\ufffd\u05d7\ufffd\ufffdwg \u000b\ufffd\u065a\ufffdO\ufffd4#\ufffd\ufffd\u001f\ufffd\u051c!\ufffd)\ufffd=\u0002\ufffd\u0018:\ufffd\ufffdm\ufffd\ufffd\ufffdL\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "postgres probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "S9\u250d\ufffd7\ufffd;\ufffd\ufffd!\u0580\/\ufffd\ufffd\ufffdEd\ufffd\ufffd\u05d7\ufffd\ufffdwg \ufffd\u065a\ufffdO\ufffd4#\ufffd\ufffd\ufffd\u051c!\ufffd)\ufffd=\ufffd:\ufffd\ufffdm\ufffd\ufffd\ufffdL\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Sonde PostgreSQL
postgres probe · via K8S API:6443 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
k8s_api_emulated
k8s_api_payload
kubernetes_probe
net_kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
螴P����F��0?��n� Ő 2p������ )�5{(b�ʸ.��N��V+hN��a�J��]+\Qb &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
螴P����F��0?��n�
Ő 2p������ )�5{(b�ʸ.��N��V+hN��a�J��]+\Qb &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
螴P����F��0?��n� Ő 2p������ )�5{(b�ʸ.��N��V+hN��a�J��]+\Qb &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ pT��2h�RS�u����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 273,
"payload_entropy": 5.692608239470574,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 14061,
"country": "DE",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25
},
"risk_score": 40,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5f70a73a5934201c2e00970f23615f0b69d2ca8a",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c12875246235211095ee8d90189e3fcf",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u87b4P\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd0?\ufffd\ufffdn\ufffd\n\u0150\u0018\t2\u000fp\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffd )\ufffd5{(b\ufffd\u0012\u02b8.\ufffd\ufffdN\ufffd\ufffdV+hN\ufffd\ufffda\ufffdJ\ufffd\ufffd]+\\Qb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u87b4P\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd0?\ufffd\ufffdn\ufffd\n\u0150\u0018\t2\u000fp\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffd )\ufffd5{(b\ufffd\u0012\u02b8.\ufffd\ufffdN\ufffd\ufffdV+hN\ufffd\ufffda\ufffdJ\ufffd\ufffd]+\\Qb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 pT\ufffd\ufffd2h\ufffdRS\ufffdu\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u87b4P\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd0?\ufffd\ufffdn\ufffd\n\u0150\u0018\t2\u000fp\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffd )\ufffd5{(b\ufffd\u0012\u02b8.\ufffd\ufffdN\ufffd\ufffdV+hN\ufffd\ufffda\ufffdJ\ufffd\ufffd]+\\Qb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9e2f355e598c556d7d525d19ffdcf0ad1ca37b0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u87b4P\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd0?\ufffd\ufffdn\ufffd\n\u0150\u0018\t2\u000fp\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffd )\ufffd5{(b\ufffd\u0012\u02b8.\ufffd\ufffdN\ufffd\ufffdV+hN\ufffd\ufffda\ufffdJ\ufffd\ufffd]+\\Qb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "\u87b4P\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd0?\ufffd\ufffdn\ufffd\n\u0150\t2p\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd )\ufffd5{(b\ufffd\u02b8.\ufffd\ufffdN\ufffd\ufffdV+hN\ufffd\ufffda\ufffdJ\ufffd\ufffd]+\\Qb&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u87b4P\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd0?\ufffd\ufffdn\ufffd\n\u0150\u0018\t2\u000fp\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffd )\ufffd5{(b\ufffd\u0012\u02b8.\ufffd\ufffdN\ufffd\ufffdV+hN\ufffd\ufffda\ufffdJ\ufffd\ufffd]+\\Qb\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "postgres probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\u87b4P\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd0?\ufffd\ufffdn\ufffd\n\u0150\t2p\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd )\ufffd5{(b\ufffd\u02b8.\ufffd\ufffdN\ufffd\ufffdV+hN\ufffd\ufffda\ufffdJ\ufffd\ufffd]+\\Qb&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
6443 · K8S API
|
k8s-api
|
Sonde PostgreSQL
postgres probe · via K8S API:6443 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
K8S-API
WAF
—
Recommandation
Surveiller
Tags
k8s_api_emulated
k8s_api_payload
kubernetes_probe
net_kubernetes_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6443
Chemin / cible
—
Service
K8S API
Payload
�/<>�� &8 �"��� Mg�[�JC�t��^s� u� �g�c�gF�L�wl�4����$CO���� &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�/<>�� &8 �"��� Mg�[�JC�t��^s� u� �g�c�gF�L�wl�4����$CO���� &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
�/<>�� &8 �"��� Mg�[�JC�t��^s� u� �g�c�gF�L�wl�4����$CO���� &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ {` �F�� �ǻ�m
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "15030300020228",
"emulator_response_len": 7,
"bytes_in": 273,
"payload_entropy": 5.640729533937578,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "k8s-api",
"app_proto": "k8s-api",
"asn": 14061,
"country": "DE",
"dst_port": 6443,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25
},
"risk_score": 40,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5f70a73a5934201c2e00970f23615f0b69d2ca8a",
"event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "k8s-api",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4d75dca3083cb22306a7150b91a8c914",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 6443,
"service": "k8s-api",
"service_name": "k8s-api",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\/<\u0006>\ufffd\ufffd\u000b&8\u001d\ufffd\"\ufffd\ufffd\ufffd\fMg\ufffd[\ufffdJC\ufffdt\ufffd\ufffd^s\ufffd\u000b \u0005u\ufffd\u001e\ufffdg\u0013\ufffdc\ufffdgF\ufffdL\ufffdwl\ufffd\u00024\ufffd\ufffd\ufffd\ufffd$CO\ufffd\ufffd\ufffd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\/<\u0006>\ufffd\ufffd\u000b&8\u001d\ufffd\"\ufffd\ufffd\ufffd\fMg\ufffd[\ufffdJC\ufffdt\ufffd\ufffd^s\ufffd\u000b \u0005u\ufffd\u001e\ufffdg\u0013\ufffdc\ufffdgF\ufffdL\ufffdwl\ufffd\u00024\ufffd\ufffd\ufffd\ufffd$CO\ufffd\ufffd\ufffd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 {`\t\ufffdF\ufffd\ufffd\u001e\ufffd\u01fb\ufffd\u0003\u0007m",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\/<\u0006>\ufffd\ufffd\u000b&8\u001d\ufffd\"\ufffd\ufffd\ufffd\fMg\ufffd[\ufffdJC\ufffdt\ufffd\ufffd^s\ufffd\u000b \u0005u\ufffd\u001e\ufffdg\u0013\ufffdc\ufffdgF\ufffdL\ufffdwl\ufffd\u00024\ufffd\ufffd\ufffd\ufffd$CO\ufffd\ufffd\ufffd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9aa0cd02a36ffb5b9b6acfa98235f9080509545d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\/<\u0006>\ufffd\ufffd\u000b&8\u001d\ufffd\"\ufffd\ufffd\ufffd\fMg\ufffd[\ufffdJC\ufffdt\ufffd\ufffd^s\ufffd\u000b \u0005u\ufffd\u001e\ufffdg\u0013\ufffdc\ufffdgF\ufffdL\ufffdwl\ufffd\u00024\ufffd\ufffd\ufffd\ufffd$CO\ufffd\ufffd\ufffd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"evidence_snippet": "\ufffd\/<>\ufffd\ufffd&8\ufffd\"\ufffd\ufffd\ufffdMg\ufffd[\ufffdJC\ufffdt\ufffd\ufffd^s\ufffd u\ufffd\ufffdg\ufffdc\ufffdgF\ufffdL\ufffdwl\ufffd4\ufffd\ufffd\ufffd\ufffd$CO\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 25,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "k8s-api",
"service_label_fr": "K8S API",
"dst_port": 6443,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-k8s-api",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\/<\u0006>\ufffd\ufffd\u000b&8\u001d\ufffd\"\ufffd\ufffd\ufffd\fMg\ufffd[\ufffdJC\ufffdt\ufffd\ufffd^s\ufffd\u000b \u0005u\ufffd\u001e\ufffdg\u0013\ufffdc\ufffdgF\ufffdL\ufffdwl\ufffd\u00024\ufffd\ufffd\ufffd\ufffd$CO\ufffd\ufffd\ufffd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 6443,
"service": "k8s-api",
"service_label_fr": "K8S API"
},
"attack_vector": "postgres probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\/<>\ufffd\ufffd&8\ufffd\"\ufffd\ufffd\ufffdMg\ufffd[\ufffdJC\ufffdt\ufffd\ufffd^s\ufffd u\ufffd\ufffdg\ufffdc\ufffdgF\ufffdL\ufffdwl\ufffd4\ufffd\ufffd\ufffd\ufffd$CO\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "6443 \u00b7 K8S API",
"emulator_service": "k8s-api",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "k8s_api",
"service_banner": "honeypot-k8s-api",
"service_os": "linux",
"dst_port": "6443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"k8s_api_emulated",
"k8s_api_payload",
"kubernetes_probe",
"net_kubernetes_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|