Fiche IP

Singapour

161.118.232.74

Activité suspecte — risque 46/100 (Moyen) — MITRE T1083 — confiance 97 % — via HTTP

FAI Oracle Corporation Première vue 12/10/2026 12:48 UTC Dernière vue 12/10/2026 12:49 UTC Risque Moyen

Période 2026-09-12 → 2026-10-12

Moyen 54/100

24h 7j 30j 90j

Synthèse

Score de risque max. 54/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 12/10/2026 12:48 UTC

Dernière observation 12/10/2026 12:49 UTC

Événements (période) 384

MITRE ATT&CK principal TA0043 215 occurrences

Pourquoi listée

Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%

Confiance 97 % — Score WAF 32 · 1 tag(s) WAF

Comparaison ASN / FAI

ASN 31898 · 161.118.192.0/18 · APNIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 384 événements sur la période pour cette IP.

161.118.202.204 Sonde fichier configuration 12/10/2026 12:53 UTC
161.118.234.54 Sonde Docker TLS 12/10/2026 12:50 UTC
161.118.240.138 Sonde HTTP alternatif (8000/TCP) 12/10/2026 12:50 UTC
140.245.112.8 Sonde Docker TLS 12/10/2026 12:49 UTC
161.118.254.100 Sonde HTTP 12/10/2026 12:49 UTC
168.107.91.104 Sonde Kubernetes API 12/10/2026 12:49 UTC
140.245.126.95 Slowloris (épuisement HTTP) 12/10/2026 12:48 UTC
134.185.92.177 Bruteforce SSH 12/10/2026 12:48 UTC

Événements (filtres)

384

Première observation

12/10/2026 12:48 UTC

Dernière observation

12/10/2026 12:49 UTC

Dernière activité (filtres)

12/10/2026 12:49 UTC

Événements 7j

384

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

Singapour unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Oracle Corporation 0 Port 9400 Sonde HTTP

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

config file probe · via HTTP:9400 · (tentative d'exploit) · → /.config/anthropic/config.json

Détails protocole

Méthode: GET
Chemin: /.config/anthropic/config.json
User-Agent: WebSiphon/next-0.1

Aperçu payload

GET /.config/anthropic/config.json HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host

Port / service

9400 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 97 % — 1 tag(s) WAF

Technique MITRE

T1083

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

Http Sensitive Upstream

Confiance

97%

Famille de menace

path_traversal config_leak_scan IP signalée (IPsum, 3 listes ou plus) IP malveillante (CINS Army)

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Timeline

384 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

384 événement(s) — page 1/8

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
12/10/2026 12:49:43 UTC	TCP	9400 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:9400 · (tentative d'exploit) · → /.config/anthropic/config.json	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.config/anthropic/config.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_sensitive_path Cible HTTP GET /.config/anthropic/config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /.config/anthropic/config.json Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97% Confiance classification 97% Risque capteur Moyen · 46 Confiance : Confiance 97 % — 1 tag(s) WAF Signaux Http Sensitive Upstream Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.config/anthropic/config.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /.config/anthropic/config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host Requête brute (extrait) GET /.config/anthropic/config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "b9d34f1378b352a8182353a71911b1bd0ab27ad5", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 149, "payload_entropy": 5.084674290087258, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 46, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4089670e91dbafa27baac3dd1b5ce1f5a9665714", "event_fingerprint": "4c09b693ef92a1741606d04481c0062e336cd01c", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "confidence": 0.97, "classification_confidence": 0.97, "precision_score": 97, "precision_signals": [ "INT-http_sensitive", "INT-upstream" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream" ], "confidence_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 97, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "4ac7778e734705ff468402586ce63164", "path_pattern_hash": "c8d9f207d19e260f1199248c19e1de30" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/.config\/anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost", "method": "GET", "path": "\/.config\/anthropic\/config.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.config\/anthropic\/config.json HTTP\/1.1", "request_sample": "GET \/.config\/anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.config\/anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost", "evidence": { "method": "GET", "path": "\/.config\/anthropic\/config.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.config\/anthropic\/config.json HTTP\/1.1", "request_sample": "GET \/.config\/anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.config\/anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0579d339949cded5906feb8cd96f50821ca52eef", "protocol_details": { "http_method": "GET", "http_path": "\/.config\/anthropic\/config.json", "request_line": "GET \/.config\/anthropic\/config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.config\/anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost", "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.config\/anthropic\/config.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP", "confidence_pct": 97, "confidence_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.config\/anthropic\/config.json", "request_line": "GET \/.config\/anthropic\/config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.config\/anthropic\/config.json", "evidence_snippet": "GET \/.config\/anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_sensitive_path" ] }
12/10/2026 12:49:43 UTC	TCP	9400 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:9400 · (tentative d'exploit) · → /.openai/config.json	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.openai/config.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_sensitive_path Cible HTTP GET /.openai/config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /.openai/config.json Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97% Confiance classification 97% Risque capteur Moyen · 46 Confiance : Confiance 97 % — 1 tag(s) WAF Signaux Http Sensitive Upstream Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.openai/config.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /.openai/config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50. Requête brute (extrait) GET /.openai/config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "b14e4e3257299ccfc684bbeb6f221c0734ec7249", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 139, "payload_entropy": 5.091947869038331, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 46, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4089670e91dbafa27baac3dd1b5ce1f5a9665714", "event_fingerprint": "2d150d0a053f2cd9558d9b19ebc2a722b68b3879", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "confidence": 0.97, "classification_confidence": 0.97, "precision_score": 97, "precision_signals": [ "INT-http_sensitive", "INT-upstream" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream" ], "confidence_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 97, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "ef932f7dbbe08dfa17df2ccbc9d6b477", "path_pattern_hash": "5963caec8ca72d603f3827e8cfa17d02" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/.openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "method": "GET", "path": "\/.openai\/config.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.openai\/config.json HTTP\/1.1", "request_sample": "GET \/.openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "evidence": { "method": "GET", "path": "\/.openai\/config.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.openai\/config.json HTTP\/1.1", "request_sample": "GET \/.openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "383a4841b4b66ea780e7d46ed00ef4da478502ef", "protocol_details": { "http_method": "GET", "http_path": "\/.openai\/config.json", "request_line": "GET \/.openai\/config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.openai\/config.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP", "confidence_pct": 97, "confidence_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.openai\/config.json", "request_line": "GET \/.openai\/config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.openai\/config.json", "evidence_snippet": "GET \/.openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_sensitive_path" ] }
12/10/2026 12:49:43 UTC	TCP	9400 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:9400 · (tentative d'exploit) · → /.config/openai/config.json	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.config/openai/config.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_sensitive_path Cible HTTP GET /.config/openai/config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /.config/openai/config.json Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97% Confiance classification 97% Risque capteur Moyen · 46 Confiance : Confiance 97 % — 1 tag(s) WAF Signaux Http Sensitive Upstream Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.config/openai/config.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /.config/openai/config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 6 Requête brute (extrait) GET /.config/openai/config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "9987317d3cd0c76fb0cfb0439c923e936a7d8c59", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 146, "payload_entropy": 5.0752382831145795, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 46, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4089670e91dbafa27baac3dd1b5ce1f5a9665714", "event_fingerprint": "080f4919fbf4704318705ac415e08b26d165f175", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "confidence": 0.97, "classification_confidence": 0.97, "precision_score": 97, "precision_signals": [ "INT-http_sensitive", "INT-upstream" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream" ], "confidence_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 97, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "634fef9b372b862439690130a32aa282", "path_pattern_hash": "4ee923870d4312045148da4021b3b669" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/.config\/openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6", "method": "GET", "path": "\/.config\/openai\/config.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.config\/openai\/config.json HTTP\/1.1", "request_sample": "GET \/.config\/openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.config\/openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6", "evidence": { "method": "GET", "path": "\/.config\/openai\/config.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.config\/openai\/config.json HTTP\/1.1", "request_sample": "GET \/.config\/openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.config\/openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8f65d4fee7a718e97e615945b8971438185afd3c", "protocol_details": { "http_method": "GET", "http_path": "\/.config\/openai\/config.json", "request_line": "GET \/.config\/openai\/config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.config\/openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6", "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.config\/openai\/config.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP", "confidence_pct": 97, "confidence_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.config\/openai\/config.json", "request_line": "GET \/.config\/openai\/config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.config\/openai\/config.json", "evidence_snippet": "GET \/.config\/openai\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_sensitive_path" ] }
12/10/2026 12:49:43 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /config/openai.json	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /config/openai.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_probe_config Cible HTTP GET /config/openai.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /config/openai.json Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /config/openai.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /config/openai.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.3 Requête brute (extrait) GET /config/openai.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "f7ab649c036fae7435fb81c8504fc9ccad7bbba2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 138, "payload_entropy": 5.096855283863939, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4dd0622338f6e11c5ccd20c61cfdb956373718b4", "event_fingerprint": "8f59a324ff8fc4014535094c9b82dbfbfbe63367", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "6bb16e843bfd30f289786283e980c066", "path_pattern_hash": "3a1c86be8826c0c477eb4c557bbfdaa4" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/config\/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "method": "GET", "path": "\/config\/openai.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/openai.json HTTP\/1.1", "request_sample": "GET \/config\/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/config\/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "evidence": { "method": "GET", "path": "\/config\/openai.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/openai.json HTTP\/1.1", "request_sample": "GET \/config\/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/config\/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "959306480cd4fbbe825192dbad7c8fb9db5a7987", "protocol_details": { "http_method": "GET", "http_path": "\/config\/openai.json", "request_line": "GET \/config\/openai.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/config\/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/openai.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/config\/openai.json", "request_line": "GET \/config\/openai.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/openai.json", "evidence_snippet": "GET \/config\/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_probe_config" ] }
12/10/2026 12:49:43 UTC	TCP	9400 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:9400 · (tentative d'exploit) · → /.anthropic/config.json	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.anthropic/config.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_sensitive_path Cible HTTP GET /.anthropic/config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /.anthropic/config.json Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97% Confiance classification 97% Risque capteur Moyen · 46 Confiance : Confiance 97 % — 1 tag(s) WAF Signaux Http Sensitive Upstream Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.anthropic/config.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /.anthropic/config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3. Requête brute (extrait) GET /.anthropic/config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "95c51e0bc4b985c60a25526006aaf202f95be5c7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 142, "payload_entropy": 5.101470406259424, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 46, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4089670e91dbafa27baac3dd1b5ce1f5a9665714", "event_fingerprint": "91e02f244820ccdbe4de6331477a71b77f88e839", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "confidence": 0.97, "classification_confidence": 0.97, "precision_score": 97, "precision_signals": [ "INT-http_sensitive", "INT-upstream" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream" ], "confidence_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 97, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "471a5a1b9e76a42143583f8a673debf0", "path_pattern_hash": "78d5c6f4ef761d694548b2034d2d3cd9" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/.anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "method": "GET", "path": "\/.anthropic\/config.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.anthropic\/config.json HTTP\/1.1", "request_sample": "GET \/.anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "evidence": { "method": "GET", "path": "\/.anthropic\/config.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.anthropic\/config.json HTTP\/1.1", "request_sample": "GET \/.anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bf8820c963b1ba852807ceeb8dbf857b4e963075", "protocol_details": { "http_method": "GET", "http_path": "\/.anthropic\/config.json", "request_line": "GET \/.anthropic\/config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.anthropic\/config.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP", "confidence_pct": 97, "confidence_breakdown": { "waf": 32, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.anthropic\/config.json", "request_line": "GET \/.anthropic\/config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.anthropic\/config.json", "evidence_snippet": "GET \/.anthropic\/config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_sensitive_path" ] }
12/10/2026 12:49:43 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /config/llm.json	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /config/llm.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_probe_config Cible HTTP GET /config/llm.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /config/llm.json Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /config/llm.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /config/llm.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9 Requête brute (extrait) GET /config/llm.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "8900496699952866baa24dff0c5c95615f4e18c3", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 135, "payload_entropy": 5.161277034609078, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4dd0622338f6e11c5ccd20c61cfdb956373718b4", "event_fingerprint": "6429a2ee703be70714fd10e99d639ab79f9d7871", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "2bd6ebef06248fcbf54b8b77d6c2c566", "path_pattern_hash": "d233e4555c6877d40ae4f02236196d4b" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/config\/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "method": "GET", "path": "\/config\/llm.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/llm.json HTTP\/1.1", "request_sample": "GET \/config\/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/config\/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "evidence": { "method": "GET", "path": "\/config\/llm.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/llm.json HTTP\/1.1", "request_sample": "GET \/config\/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/config\/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "670ee6d66790c774463efe9354eb4006125307b6", "protocol_details": { "http_method": "GET", "http_path": "\/config\/llm.json", "request_line": "GET \/config\/llm.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/config\/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/llm.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/config\/llm.json", "request_line": "GET \/config\/llm.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/llm.json", "evidence_snippet": "GET \/config\/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_probe_config" ] }
12/10/2026 12:49:43 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /config/models.json	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /config/models.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_probe_config Cible HTTP GET /config/models.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /config/models.json Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /config/models.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /config/models.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.3 Requête brute (extrait) GET /config/models.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "4f76be17b55954981fb716e585fa64bd47d86e61", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 138, "payload_entropy": 5.148865696682108, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4dd0622338f6e11c5ccd20c61cfdb956373718b4", "event_fingerprint": "da68b4bd57b929c53838f6003af5623d67333892", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "83d3681634c623811095397ae1e5e015", "path_pattern_hash": "3d39d4324a935a8c18700bae1a9bc2c0" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/config\/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "method": "GET", "path": "\/config\/models.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/models.json HTTP\/1.1", "request_sample": "GET \/config\/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/config\/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "evidence": { "method": "GET", "path": "\/config\/models.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/models.json HTTP\/1.1", "request_sample": "GET \/config\/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/config\/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "98ea3ef56768ede02dd0d836a66fe9a56d37517a", "protocol_details": { "http_method": "GET", "http_path": "\/config\/models.json", "request_line": "GET \/config\/models.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/config\/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/models.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/config\/models.json", "request_line": "GET \/config\/models.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/models.json", "evidence_snippet": "GET \/config\/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_probe_config" ] }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /config/ai.json	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /config/ai.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_probe_config Cible HTTP GET /config/ai.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /config/ai.json Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /config/ai.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /config/ai.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:94 Requête brute (extrait) GET /config/ai.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "e22227e41a70b83d1097bbc9db23d0b23238a31a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 134, "payload_entropy": 5.117864568246228, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4dd0622338f6e11c5ccd20c61cfdb956373718b4", "event_fingerprint": "020801ea0e3807209b9f725ab170e48170a270db", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "bed0e8f08d1ba16d0cde9cb5eeb17c6e", "path_pattern_hash": "5c9a8e1afb61e47412fe2c409b4fb995" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/config\/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "method": "GET", "path": "\/config\/ai.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/ai.json HTTP\/1.1", "request_sample": "GET \/config\/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/config\/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "evidence": { "method": "GET", "path": "\/config\/ai.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/config\/ai.json HTTP\/1.1", "request_sample": "GET \/config\/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/config\/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f335d8f93ba158dd9b1e62f3c7eec6c421997b46", "protocol_details": { "http_method": "GET", "http_path": "\/config\/ai.json", "request_line": "GET \/config\/ai.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/config\/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/ai.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/config\/ai.json", "request_line": "GET \/config\/ai.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/config\/ai.json", "evidence_snippet": "GET \/config\/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_probe_config" ] }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /model-config.json	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /model-config.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /model-config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /model-config.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /model-config.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /model-config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33 Requête brute (extrait) GET /model-config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "471df40500c10b7f9c73ddb10e18ebd8a040f35c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 137, "payload_entropy": 5.150416985012936, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "279c33c29e7d2fc52ecea1b008208884759f28ea", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "047ed686afb85e5a439b5a39aebf1e88", "path_pattern_hash": "6d6c7e5eceb7221750b0a3d8af4c57a1" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/model-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "method": "GET", "path": "\/model-config.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/model-config.json HTTP\/1.1", "request_sample": "GET \/model-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/model-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "evidence": { "method": "GET", "path": "\/model-config.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/model-config.json HTTP\/1.1", "request_sample": "GET \/model-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/model-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b9d9e1153f6925644ab668faf5de29d6c01d0359", "protocol_details": { "http_method": "GET", "http_path": "\/model-config.json", "request_line": "GET \/model-config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/model-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/model-config.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/model-config.json", "request_line": "GET \/model-config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/model-config.json", "evidence_snippet": "GET \/model-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /model_config.json	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /model_config.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /model_config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /model_config.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /model_config.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /model_config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33 Requête brute (extrait) GET /model_config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "c1eb0be627c03329f3cc8ad4fbb3836610f77e1a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 137, "payload_entropy": 5.174103937551888, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "5b49df8cd49a80adf573ee9326435427760cd27f", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "b503143f1b7db7e546615371db9ac88d", "path_pattern_hash": "4cbd0bdb4c92cf437aa75fa3d3754e01" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/model_config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "method": "GET", "path": "\/model_config.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/model_config.json HTTP\/1.1", "request_sample": "GET \/model_config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/model_config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "evidence": { "method": "GET", "path": "\/model_config.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/model_config.json HTTP\/1.1", "request_sample": "GET \/model_config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/model_config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0e52debe2cb8be142aed4189f0011469181c87bb", "protocol_details": { "http_method": "GET", "http_path": "\/model_config.json", "request_line": "GET \/model_config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/model_config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/model_config.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/model_config.json", "request_line": "GET \/model_config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/model_config.json", "evidence_snippet": "GET \/model_config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /ai-model-pools.json	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /ai-model-pools.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /ai-model-pools.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /ai-model-pools.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /ai-model-pools.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /ai-model-pools.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50. Requête brute (extrait) GET /ai-model-pools.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "f18c7d166a3bab9a0057ad5f929f84110a04099d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 139, "payload_entropy": 5.144070980533558, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "9f1ee39fb85b87c203c688d07e383a22867b0b43", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "51efea0505478ff13f5b6526ecefc89a", "path_pattern_hash": "ce953a1c07500442e7c08ad341592961" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/ai-model-pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "method": "GET", "path": "\/ai-model-pools.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai-model-pools.json HTTP\/1.1", "request_sample": "GET \/ai-model-pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai-model-pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "evidence": { "method": "GET", "path": "\/ai-model-pools.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai-model-pools.json HTTP\/1.1", "request_sample": "GET \/ai-model-pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai-model-pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "65fa8937ad3f239f4dd87a3d880e70860b5a4dcf", "protocol_details": { "http_method": "GET", "http_path": "\/ai-model-pools.json", "request_line": "GET \/ai-model-pools.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ai-model-pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ai-model-pools.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/ai-model-pools.json", "request_line": "GET \/ai-model-pools.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ai-model-pools.json", "evidence_snippet": "GET \/ai-model-pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /ai_model_pools.json	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /ai_model_pools.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /ai_model_pools.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /ai_model_pools.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /ai_model_pools.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /ai_model_pools.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50. Requête brute (extrait) GET /ai_model_pools.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "8efca760c8ac3b1aca7bf99d9a891b397d8c6248", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 139, "payload_entropy": 5.178997260909624, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "fa1e262d174e622309309ac4f5628cc0ff7a6a83", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "af87c5c3384776128de05aeea46e7b2f", "path_pattern_hash": "58a630d171aa64d364dd44a924629b9e" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/ai_model_pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "method": "GET", "path": "\/ai_model_pools.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai_model_pools.json HTTP\/1.1", "request_sample": "GET \/ai_model_pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai_model_pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "evidence": { "method": "GET", "path": "\/ai_model_pools.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai_model_pools.json HTTP\/1.1", "request_sample": "GET \/ai_model_pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai_model_pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a4ea6ad30f6afda2678a28b96275f7e8cd3bc745", "protocol_details": { "http_method": "GET", "http_path": "\/ai_model_pools.json", "request_line": "GET \/ai_model_pools.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ai_model_pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ai_model_pools.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/ai_model_pools.json", "request_line": "GET \/ai_model_pools.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ai_model_pools.json", "evidence_snippet": "GET \/ai_model_pools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /aimodelpools.json	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /aimodelpools.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /aimodelpools.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /aimodelpools.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /aimodelpools.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /aimodelpools.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33 Requête brute (extrait) GET /aimodelpools.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "186e9a3ffb282495c2bbe9c40f1fe56fc127716d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 137, "payload_entropy": 5.144366463674904, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "11767e25447139239e9ef71d80c1d458c4e934b4", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "45c0863c6eea249e099bcc8104ccbaec", "path_pattern_hash": "e0c5a04958233977b172593c0167c02e" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/aimodelpools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "method": "GET", "path": "\/aimodelpools.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/aimodelpools.json HTTP\/1.1", "request_sample": "GET \/aimodelpools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/aimodelpools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "evidence": { "method": "GET", "path": "\/aimodelpools.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/aimodelpools.json HTTP\/1.1", "request_sample": "GET \/aimodelpools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/aimodelpools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2bca5d0ca4b516e0ad223b8de6fb1f6a4f0fd836", "protocol_details": { "http_method": "GET", "http_path": "\/aimodelpools.json", "request_line": "GET \/aimodelpools.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/aimodelpools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/aimodelpools.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/aimodelpools.json", "request_line": "GET \/aimodelpools.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/aimodelpools.json", "evidence_snippet": "GET \/aimodelpools.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /api/chat	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /api/chat UA WebSiphon/next-0.1 Émulateur HTTP WAF 10 Recommandation Surveiller Tags 950468:nosqli-3 950600:k8s-api http_probe_api Cible HTTP GET /api/chat TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /api/chat Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, k8s-api · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /api/chat HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 k8s-api Payload (extrait) GET /api/chat HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "941410b4c15ddf3dcc599b13da13aaae5a039a5e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 128, "payload_entropy": 5.085452348622289, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 48, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8b165c229a7304406256b9c81a47c20ae5f7c23d", "event_fingerprint": "9068c60526647043038e8ae7efcb479e8202012d", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "0c894b93fb7cd9ffb5f0b179077b6c06", "path_pattern_hash": "5d4b1ce1ab6fc39a8ced60a839a7d62a" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/api\/chat HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/api\/chat", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/chat HTTP\/1.1", "request_sample": "GET \/api\/chat HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/chat HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/api\/chat", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/chat HTTP\/1.1", "request_sample": "GET \/api\/chat HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/chat HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5e0c6ffd4902f15401ef9ec1fe0af136f8813e9d", "protocol_details": { "http_method": "GET", "http_path": "\/api\/chat", "request_line": "GET \/api\/chat HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/chat HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/chat", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/chat", "request_line": "GET \/api\/chat HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/chat", "evidence_snippet": "GET \/api\/chat HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "950600:k8s-api", "http_probe_api" ] }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:9400 · (tentative d'exploit) · → /v1/deployments	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /v1/deployments UA WebSiphon/next-0.1 Émulateur HTTP WAF 14 Recommandation Surveiller Tags 950316:lfi-14 950468:nosqli-3 Cible HTTP GET /v1/deployments TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /v1/deployments Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 45 Confiance : Confiance 59 % — 2 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /v1/deployments HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF lfi-14 nosqli-3 Payload (extrait) GET /v1/deployments HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:94 Requête brute (extrait) GET /v1/deployments HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "c4e64ac1447fb84b2f60444692147c06304ee739", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 134, "payload_entropy": 5.162531375800687, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 64, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "2f5fc45296eeff024ea05781621dba25fab698f3", "event_fingerprint": "aeb1a46e3058df92dd91970bf2a90013542d1442", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "confidence_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "44aca0365965a25d94e40869adc6c6d5", "path_pattern_hash": "893316b84786d384b8c44efd81bec328" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/v1\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "method": "GET", "path": "\/v1\/deployments", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3" ], "waf_rule_names": [ "lfi-14", "nosqli-3" ], "request_line": "GET \/v1\/deployments HTTP\/1.1", "request_sample": "GET \/v1\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/v1\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "evidence": { "method": "GET", "path": "\/v1\/deployments", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3" ], "waf_rule_names": [ "lfi-14", "nosqli-3" ], "request_line": "GET \/v1\/deployments HTTP\/1.1", "request_sample": "GET \/v1\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/v1\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "aa9a52d5945973d208049d76626981aae43960fa", "protocol_details": { "http_method": "GET", "http_path": "\/v1\/deployments", "request_line": "GET \/v1\/deployments HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/v1\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/deployments", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/v1\/deployments", "request_line": "GET \/v1\/deployments HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/deployments", "evidence_snippet": "GET \/v1\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950316:lfi-14", "950468:nosqli-3" ] }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /api/deployments	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /api/deployments UA WebSiphon/next-0.1 Émulateur HTTP WAF 10 Recommandation Surveiller Tags 950468:nosqli-3 950600:k8s-api http_probe_api Cible HTTP GET /api/deployments TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /api/deployments Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, k8s-api · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /api/deployments HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 k8s-api Payload (extrait) GET /api/deployments HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9 Requête brute (extrait) GET /api/deployments HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "f0853847faae0d063bd6cfe2e3e98ac2d4f67922", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 135, "payload_entropy": 5.131730247655454, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 48, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8b165c229a7304406256b9c81a47c20ae5f7c23d", "event_fingerprint": "4a832ab7c17005ed109892373e8ce18494a84c84", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "f5139ef035311423edd2a6d037483b85", "path_pattern_hash": "27a1a336415b8ad6fd18b5cf458d8c6c" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/api\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "method": "GET", "path": "\/api\/deployments", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/deployments HTTP\/1.1", "request_sample": "GET \/api\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "evidence": { "method": "GET", "path": "\/api\/deployments", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/deployments HTTP\/1.1", "request_sample": "GET \/api\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cad07fc188304c293f54a9330d27e327184634f8", "protocol_details": { "http_method": "GET", "http_path": "\/api\/deployments", "request_line": "GET \/api\/deployments HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/deployments", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/deployments", "request_line": "GET \/api\/deployments HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/deployments", "evidence_snippet": "GET \/api\/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "950600:k8s-api", "http_probe_api" ] }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /chat/completions	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /chat/completions UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 Cible HTTP GET /chat/completions TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /chat/completions Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /chat/completions HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /chat/completions HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33: Requête brute (extrait) GET /chat/completions HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "6ba793c2ee60508ffb7b090e5273237ddde7eee6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 136, "payload_entropy": 5.103257541380119, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 1, "anomaly_count": 0, "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf", "event_fingerprint": "2e507ae8660cb5c6a88c4ba82cfb20f53b0c8745", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "80b013a31382da14a04bda10176f0498", "path_pattern_hash": "99f784fabe729a030d8d4ccea76f30da" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "method": "GET", "path": "\/chat\/completions", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/chat\/completions HTTP\/1.1", "request_sample": "GET \/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "evidence": { "method": "GET", "path": "\/chat\/completions", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/chat\/completions HTTP\/1.1", "request_sample": "GET \/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "25d7de46a1d80349342521ae4c0030c302409a02", "protocol_details": { "http_method": "GET", "http_path": "\/chat\/completions", "request_line": "GET \/chat\/completions HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/chat\/completions", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/chat\/completions", "request_line": "GET \/chat\/completions HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/chat\/completions", "evidence_snippet": "GET \/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3" ] }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /api/models	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /api/models UA WebSiphon/next-0.1 Émulateur HTTP WAF 10 Recommandation Surveiller Tags 950468:nosqli-3 950600:k8s-api http_probe_api Cible HTTP GET /api/models TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /api/models Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, k8s-api · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /api/models HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 k8s-api Payload (extrait) GET /api/models HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "605f19cd9e4e064426f103c259b8babf37b5441a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.131521068394738, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 48, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8b165c229a7304406256b9c81a47c20ae5f7c23d", "event_fingerprint": "0992990c9824caffc98280c71a15f423a6330236", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "e84f676c76f1205a90b28145e8c45967", "path_pattern_hash": "242d5a2b2e976eafb97b35f8cb36fa01" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/api\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n", "method": "GET", "path": "\/api\/models", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/models HTTP\/1.1", "request_sample": "GET \/api\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/api\/models", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/models HTTP\/1.1", "request_sample": "GET \/api\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "442fe38095a2e186a689be516b160351bf8b1be9", "protocol_details": { "http_method": "GET", "http_path": "\/api\/models", "request_line": "GET \/api\/models HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/models", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/models", "request_line": "GET \/api\/models HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/models", "evidence_snippet": "GET \/api\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "950600:k8s-api", "http_probe_api" ] }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /deployments	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /deployments UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /deployments TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /deployments Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /deployments HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /deployments HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "e11776c7e91d8ac1e55d978a7c7ac99f944e7b92", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 131, "payload_entropy": 5.138598618394121, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "d7ba7ae861f95d17ebdc7493b628ca7e7cf1abf9", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "6b5b6e22bcbdc064d8cc338bee28b886", "path_pattern_hash": "56b436ec65372e7f028e1b81d0741aa7" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r", "method": "GET", "path": "\/deployments", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/deployments HTTP\/1.1", "request_sample": "GET \/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/deployments", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/deployments HTTP\/1.1", "request_sample": "GET \/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fb8bdd230d51a08ca1e1b67d690d7a5eb2e10e7f", "protocol_details": { "http_method": "GET", "http_path": "\/deployments", "request_line": "GET \/deployments HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/deployments", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/deployments", "request_line": "GET \/deployments HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/deployments", "evidence_snippet": "GET \/deployments HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /openai/models	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /openai/models UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 Cible HTTP GET /openai/models TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /openai/models Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /openai/models HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /openai/models HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:940 Requête brute (extrait) GET /openai/models HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "214cc2aaffbc670165a0b3eb9174f930b499ae89", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 133, "payload_entropy": 5.114272520742944, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 1, "anomaly_count": 0, "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf", "event_fingerprint": "cf158649268876cbb894e118180d0c7082e87267", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "5cbb515fef92f2d6bea305c61747662c", "path_pattern_hash": "8a8b40c414e088a9c6eabe380ea20289" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/openai\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940", "method": "GET", "path": "\/openai\/models", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/openai\/models HTTP\/1.1", "request_sample": "GET \/openai\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/openai\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940", "evidence": { "method": "GET", "path": "\/openai\/models", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/openai\/models HTTP\/1.1", "request_sample": "GET \/openai\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/openai\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "77d3a288d501d54a0e450f744425c7b5d6c84997", "protocol_details": { "http_method": "GET", "http_path": "\/openai\/models", "request_line": "GET \/openai\/models HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/openai\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/openai\/models", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/openai\/models", "request_line": "GET \/openai\/models HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/openai\/models", "evidence_snippet": "GET \/openai\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3" ] }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /deployments.json	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /deployments.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /deployments.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /deployments.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /deployments.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /deployments.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33: Requête brute (extrait) GET /deployments.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "c5a7720a5c54c6e0f14d70f8457036aa557295b7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 136, "payload_entropy": 5.152767318132573, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "682371e4522bb4581017a20b1c56544c37b7005c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "77de45801579ce0f997f7afd3adfb0da", "path_pattern_hash": "eb91fd25260fc4ca7496a6538319617e" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/deployments.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "method": "GET", "path": "\/deployments.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/deployments.json HTTP\/1.1", "request_sample": "GET \/deployments.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/deployments.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "evidence": { "method": "GET", "path": "\/deployments.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/deployments.json HTTP\/1.1", "request_sample": "GET \/deployments.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/deployments.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "15341d845bbd549184e8c2bcf1344e778e0b2e75", "protocol_details": { "http_method": "GET", "http_path": "\/deployments.json", "request_line": "GET \/deployments.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/deployments.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/deployments.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/deployments.json", "request_line": "GET \/deployments.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/deployments.json", "evidence_snippet": "GET \/deployments.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /model.json	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /model.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /model.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /model.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /model.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /model.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "46965a951e5543a3ab059e4ca3943d277dce4b7d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.152014332909583, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "5311d3e8c09f1105b6709275abcfd19c23cd0e55", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "b64dc2117bcb64c81083d4fd67e6fef2", "path_pattern_hash": "1bf1eacc380f891e02c1451c75eeea51" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/model.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n", "method": "GET", "path": "\/model.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/model.json HTTP\/1.1", "request_sample": "GET \/model.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/model.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/model.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/model.json HTTP\/1.1", "request_sample": "GET \/model.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/model.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "52cdedeb9365eeac9874dc7030edced34167cf46", "protocol_details": { "http_method": "GET", "http_path": "\/model.json", "request_line": "GET \/model.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/model.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/model.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/model.json", "request_line": "GET \/model.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/model.json", "evidence_snippet": "GET \/model.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /models.json	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /models.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /models.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /models.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /models.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /models.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "fc7ce3e2aab6188c5aaed001cd29c0d19280b767", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 131, "payload_entropy": 5.152575177771878, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "5aaf677a32a6b816fe16d6be1d7798a70edf4469", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "6205bbc623f5d30ee50787368e9e7521", "path_pattern_hash": "823b1342d09770c8136f406c222726cf" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r", "method": "GET", "path": "\/models.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/models.json HTTP\/1.1", "request_sample": "GET \/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/models.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/models.json HTTP\/1.1", "request_sample": "GET \/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d8de6c451430b7d57ba46fbf07c3fe8738ad6028", "protocol_details": { "http_method": "GET", "http_path": "\/models.json", "request_line": "GET \/models.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/models.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/models.json", "request_line": "GET \/models.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/models.json", "evidence_snippet": "GET \/models.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /llm.yaml	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /llm.yaml UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /llm.yaml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /llm.yaml Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /llm.yaml HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /llm.yaml HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yaml", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "99d1c203b28c7b66ed5069d9efd0f4b150d7ec37", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 128, "payload_entropy": 5.173429887128853, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "19cacce9cfdd5d221f3384eda1203c42612fa0dc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "79e11546b4626f408e4f87166e25a3c3", "path_pattern_hash": "33892f5b3c875eb00e260edd2c62befd" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/llm.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/llm.yaml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/llm.yaml HTTP\/1.1", "request_sample": "GET \/llm.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/llm.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/llm.yaml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/llm.yaml HTTP\/1.1", "request_sample": "GET \/llm.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/llm.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "44d642dd750cd9afe5f45ffb04f37009041dbadc", "protocol_details": { "http_method": "GET", "http_path": "\/llm.yaml", "request_line": "GET \/llm.yaml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/llm.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/llm.yaml", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/llm.yaml", "request_line": "GET \/llm.yaml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/llm.yaml", "evidence_snippet": "GET \/llm.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /llm.yml	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /llm.yml UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /llm.yml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /llm.yml Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /llm.yml HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /llm.yml HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yml", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "fc9a682174b966e08461669364b87b099a0f0a1d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 127, "payload_entropy": 5.176154498007832, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "0af20b1bf2a6611fe12ae89dccb333b7cf619747", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "c3677eaa082b2602af198734e0329012", "path_pattern_hash": "72a4ccf5ff5dec4c7d0f7ee2ce259438" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/llm.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/llm.yml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/llm.yml HTTP\/1.1", "request_sample": "GET \/llm.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/llm.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/llm.yml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/llm.yml HTTP\/1.1", "request_sample": "GET \/llm.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/llm.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38ab0a8b742a8e82ef319dc65798bbfd3a9bc7ca", "protocol_details": { "http_method": "GET", "http_path": "\/llm.yml", "request_line": "GET \/llm.yml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/llm.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/llm.yml", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/llm.yml", "request_line": "GET \/llm.yml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/llm.yml", "evidence_snippet": "GET \/llm.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Sonde HTTP http · via HTTP:9400 · (sonde / probe) · → /llm.json	Faible	Faible · 5
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /llm.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /llm.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /llm.json Service HTTP Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 5 Confiance : Confiance 55 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /llm.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /llm.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "3d24826c08438b2acdd04da0d97bac5d2a22c56e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 128, "payload_entropy": 5.1652628437099715, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 5, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "9a55d266efa34aa90f686cbc8203fd99a76211cc", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "557e2802b5355c138e62d272c1a00544", "path_pattern_hash": "4093566c2fa57915ae4c6d3769f0a760" }, "service_name": "http", "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 5 }, "payload_preview": "GET \/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/llm.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/llm.json HTTP\/1.1", "request_sample": "GET \/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/llm.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/llm.json HTTP\/1.1", "request_sample": "GET \/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.55, "classification_confidence": 0.55, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "83e61e1c01d48355432d6f94d3fefba5ca36e51c", "protocol_details": { "http_method": "GET", "http_path": "\/llm.json", "request_line": "GET \/llm.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/llm.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 5, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/llm.json", "request_line": "GET \/llm.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/llm.json", "evidence_snippet": "GET \/llm.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Sonde HTTP http · via HTTP:9400 · (sonde / probe) · → /ai-config.json	Faible	Faible · 5
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /ai-config.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /ai-config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /ai-config.json Service HTTP Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 5 Confiance : Confiance 55 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /ai-config.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /ai-config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:94 Requête brute (extrait) GET /ai-config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "f8fca1e1f4c7e7685e8ebddb83b5632d73aec48e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 134, "payload_entropy": 5.120584926280558, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 5, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "440b0e08732a107368fc89ed8f8ba8601966be7b", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "9b39e333aa3a688d674c1d12f52494e2", "path_pattern_hash": "642e5bc0f6e366258778e0aac6f372d1" }, "service_name": "http", "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 5 }, "payload_preview": "GET \/ai-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "method": "GET", "path": "\/ai-config.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai-config.json HTTP\/1.1", "request_sample": "GET \/ai-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "evidence": { "method": "GET", "path": "\/ai-config.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai-config.json HTTP\/1.1", "request_sample": "GET \/ai-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.55, "classification_confidence": 0.55, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4a04fc094f7a4ff0cf6176b1fe4caadd37f736c7", "protocol_details": { "http_method": "GET", "http_path": "\/ai-config.json", "request_line": "GET \/ai-config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ai-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai-config.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 5, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/ai-config.json", "request_line": "GET \/ai-config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai-config.json", "evidence_snippet": "GET \/ai-config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Sonde HTTP http · via HTTP:9400 · (sonde / probe) · → /ai.config.json	Faible	Faible · 5
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /ai.config.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /ai.config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /ai.config.json Service HTTP Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 5 Confiance : Confiance 55 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /ai.config.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /ai.config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:94 Requête brute (extrait) GET /ai.config.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "2af58c96d946000ef132219f199bac4162ea26f2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 134, "payload_entropy": 5.1138939042489175, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 5, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "fed495a408ea7fdb3af2e6d3c1e87dbb280e33be", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "43f3959c0f42c40d4258f467b92c0f00", "path_pattern_hash": "075a676deb8b318fd2ac8df4c4ae06c5" }, "service_name": "http", "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 5 }, "payload_preview": "GET \/ai.config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "method": "GET", "path": "\/ai.config.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai.config.json HTTP\/1.1", "request_sample": "GET \/ai.config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai.config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "evidence": { "method": "GET", "path": "\/ai.config.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai.config.json HTTP\/1.1", "request_sample": "GET \/ai.config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai.config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.55, "classification_confidence": 0.55, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "884653d0aa8bf36ed1271311fe65a8f782fe9b38", "protocol_details": { "http_method": "GET", "http_path": "\/ai.config.json", "request_line": "GET \/ai.config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ai.config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai.config.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 5, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/ai.config.json", "request_line": "GET \/ai.config.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai.config.json", "evidence_snippet": "GET \/ai.config.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Sonde HTTP http · via HTTP:9400 · (sonde / probe) · → /ai.yaml	Faible	Faible · 5
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /ai.yaml UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /ai.yaml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /ai.yaml Service HTTP Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 5 Confiance : Confiance 55 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /ai.yaml HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /ai.yaml HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yaml", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "ca9f45f12722c70a4f94ab1928dbe68dd375e676", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 127, "payload_entropy": 5.154462470431741, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 5, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "1f86d0a185250378b6ed8a349e6672eb8c5cf027", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "d62f7c7b656fb8d81ce7b6801df3d119", "path_pattern_hash": "e26f60fb7c80a627c978fad6dde36615" }, "service_name": "http", "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 5 }, "payload_preview": "GET \/ai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/ai.yaml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai.yaml HTTP\/1.1", "request_sample": "GET \/ai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/ai.yaml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai.yaml HTTP\/1.1", "request_sample": "GET \/ai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.55, "classification_confidence": 0.55, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7e3fc336d7f455a8d0b2a9cac5fb684e5b8d0067", "protocol_details": { "http_method": "GET", "http_path": "\/ai.yaml", "request_line": "GET \/ai.yaml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai.yaml", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 5, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/ai.yaml", "request_line": "GET \/ai.yaml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai.yaml", "evidence_snippet": "GET \/ai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Sonde HTTP http · via HTTP:9400 · (sonde / probe) · → /ai.yml	Faible	Faible · 5
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /ai.yml UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /ai.yml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /ai.yml Service HTTP Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 5 Confiance : Confiance 55 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /ai.yml HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /ai.yml HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yml", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "2e5d3f7554db240adee1911970cc7f6d640e4ab6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 126, "payload_entropy": 5.159453836632111, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 5, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "9164d3a73187da68612e8cb75fb1899849f5dad0", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "e3494f925ff638902c8c7b235b1143c2", "path_pattern_hash": "239d3c3ac3ae15eb8de87977fbc4535a" }, "service_name": "http", "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 5 }, "payload_preview": "GET \/ai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/ai.yml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai.yml HTTP\/1.1", "request_sample": "GET \/ai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/ai.yml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai.yml HTTP\/1.1", "request_sample": "GET \/ai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.55, "classification_confidence": 0.55, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cca7106a55bfa42e0b3a36b2b9c3de7ab5ef5c9f", "protocol_details": { "http_method": "GET", "http_path": "\/ai.yml", "request_line": "GET \/ai.yml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai.yml", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 5, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/ai.yml", "request_line": "GET \/ai.yml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai.yml", "evidence_snippet": "GET \/ai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Sonde HTTP http · via HTTP:9400 · (sonde / probe) · → /ai.json	Faible	Faible · 5
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /ai.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /ai.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /ai.json Service HTTP Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 5 Confiance : Confiance 55 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /ai.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /ai.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "5ea7a58d9b2ed94f23ea5076a5f5ad665a1ffd10", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 127, "payload_entropy": 5.1229664074396135, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 5, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "68b6ee3ff777fec9f7f37f7354badca5c7d078e1", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "bee74c7ab9c1f824c41957153aba59ff", "path_pattern_hash": "076307368102b29b1df227b888f11474" }, "service_name": "http", "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 5 }, "payload_preview": "GET \/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/ai.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai.json HTTP\/1.1", "request_sample": "GET \/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/ai.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/ai.json HTTP\/1.1", "request_sample": "GET \/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.55, "classification_confidence": 0.55, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28755744e8ebde40857ad1b1119aba0ca30a1809", "protocol_details": { "http_method": "GET", "http_path": "\/ai.json", "request_line": "GET \/ai.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 5, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/ai.json", "request_line": "GET \/ai.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/ai.json", "evidence_snippet": "GET \/ai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:42 UTC	TCP	9400 · HTTP	http	Sonde HTTP http · via HTTP:9400 · (sonde / probe) · → /openai.yml	Faible	Faible · 5
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /openai.yml UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /openai.yml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /openai.yml Service HTTP Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Faible · 5 Confiance : Confiance 55 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /openai.yml HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /openai.yml HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yml", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "bb93479ab4a614aebe7ce93c4c3a4c5aca2a6850", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 130, "payload_entropy": 5.141668348540765, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 5, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "49638e710176a536e52c8a678f709f8db4fef6ce", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "07cb6296a063105fee232bf777409ebf", "path_pattern_hash": "c573c60c4039ace9f89bc951e4b6b0ab" }, "service_name": "http", "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 5 }, "payload_preview": "GET \/openai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n", "method": "GET", "path": "\/openai.yml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/openai.yml HTTP\/1.1", "request_sample": "GET \/openai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/openai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/openai.yml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/openai.yml HTTP\/1.1", "request_sample": "GET \/openai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/openai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "confidence": 0.55, "classification_confidence": 0.55, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8ac442b4fe3f09db82537867d6bdce0dadc399f1", "protocol_details": { "http_method": "GET", "http_path": "\/openai.yml", "request_line": "GET \/openai.yml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/openai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/openai.yml", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 5 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 5, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/openai.yml", "request_line": "GET \/openai.yml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/openai.yml", "evidence_snippet": "GET \/openai.yml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 55 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:35 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /openai.yaml	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /openai.yaml UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /openai.yaml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /openai.yaml Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /openai.yaml HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /openai.yaml HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yaml", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "57eba30d8d8dd8c84cdb4beb4e641da9d304dbe0", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 131, "payload_entropy": 5.13730800219936, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "0e4cb48657a5cf876e1c0212fb4b39431b1fb363", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "a65a3a4e4bc0a769fa6c83f9bcdddce6", "path_pattern_hash": "46e57ca0c95eeedab99d883f82edd0bb" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/openai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r", "method": "GET", "path": "\/openai.yaml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/openai.yaml HTTP\/1.1", "request_sample": "GET \/openai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/openai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/openai.yaml", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/openai.yaml HTTP\/1.1", "request_sample": "GET \/openai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/openai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c78e0bb858a013fcf94e89e8931d0cb750690b0", "protocol_details": { "http_method": "GET", "http_path": "\/openai.yaml", "request_line": "GET \/openai.yaml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/openai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/openai.yaml", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/openai.yaml", "request_line": "GET \/openai.yaml HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/openai.yaml", "evidence_snippet": "GET \/openai.yaml HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:35 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /health	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /health UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_probe_health Cible HTTP GET /health TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /health Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 signal(aux) capteur Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /health HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /health HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "0bb4da595b0ae9c7552fe95627a4f99f024f8c89", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 126, "payload_entropy": 5.0984505163286, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 1, "anomaly_count": 0, "campaign_key": "9591e8bbed3c04e9f31b7ffddd9e934bc70c0e39", "event_fingerprint": "4d5ada93672e5462168aaf3b9abaf2c6af8cf5d2", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "b3234d11c914971cf84b187d591d2aed", "path_pattern_hash": "0587c50e302cd55b995100e6e49c0789" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/health HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/health", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/health HTTP\/1.1", "request_sample": "GET \/health HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/health HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/health", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/health HTTP\/1.1", "request_sample": "GET \/health HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/health HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "08739726f8075ed6d56478cb78c07be890a8f544", "protocol_details": { "http_method": "GET", "http_path": "\/health", "request_line": "GET \/health HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/health HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/health", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/health", "request_line": "GET \/health HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/health", "evidence_snippet": "GET \/health HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_probe_health" ] }
12/10/2026 12:49:35 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /openai.json	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /openai.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /openai.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /openai.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /openai.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /openai.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "d95727c7ef58e665df02a6570c7cef1133d078ac", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 131, "payload_entropy": 5.102146911384195, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "d67fd13497768738233a80be5bff4767712746ce", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "c4a9968c269fd23a45055aa3bfe30992", "path_pattern_hash": "0e464d1bbdaabd623397a102126a2f2d" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r", "method": "GET", "path": "\/openai.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/openai.json HTTP\/1.1", "request_sample": "GET \/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/openai.json", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/openai.json HTTP\/1.1", "request_sample": "GET \/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c378d0d1bbc7d1cb35267a3a41f67933eb3a2e8", "protocol_details": { "http_method": "GET", "http_path": "\/openai.json", "request_line": "GET \/openai.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/openai.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/openai.json", "request_line": "GET \/openai.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/openai.json", "evidence_snippet": "GET \/openai.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:35 UTC	TCP	9400 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:9400 · (tentative d'exploit) · → /v1/chat/completions	Élevée	Moyen · 53
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /v1/chat/completions UA WebSiphon/next-0.1 Émulateur HTTP WAF 14 Recommandation Investiguer Tags 950316:lfi-14 950468:nosqli-3 http_llm_api_scrape Cible HTTP GET /v1/chat/completions TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /v1/chat/completions Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 53 Confiance : Confiance 59 % — 2 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /v1/chat/completions HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF lfi-14 nosqli-3 Payload (extrait) GET /v1/chat/completions HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50. Requête brute (extrait) GET /v1/chat/completions HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "677ecf6c8ea5590ca72079d2c8422b224d690b39", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 139, "payload_entropy": 5.126155692794903, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 64, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 10, "risk_granularity": 2.2, "risk_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 53, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8d07c5be8c41f7db0509d74b95e556b6eed175d7", "event_fingerprint": "f07ce7790528fdaf4cc4e03d0a457831bb389a9d", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "confidence_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "8cff92e5997c326aa323e0a3a9976a88", "path_pattern_hash": "2e3b96fc129d494b171c50c85551ee22" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/v1\/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "method": "GET", "path": "\/v1\/chat\/completions", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3" ], "waf_rule_names": [ "lfi-14", "nosqli-3" ], "request_line": "GET \/v1\/chat\/completions HTTP\/1.1", "request_sample": "GET \/v1\/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/v1\/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "evidence": { "method": "GET", "path": "\/v1\/chat\/completions", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3" ], "waf_rule_names": [ "lfi-14", "nosqli-3" ], "request_line": "GET \/v1\/chat\/completions HTTP\/1.1", "request_sample": "GET \/v1\/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/v1\/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "223c55dcfff68f3383659daf413f4e129dd0f63a", "protocol_details": { "http_method": "GET", "http_path": "\/v1\/chat\/completions", "request_line": "GET \/v1\/chat\/completions HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/v1\/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/chat\/completions", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/v1\/chat\/completions", "request_line": "GET \/v1\/chat\/completions HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/chat\/completions", "evidence_snippet": "GET \/v1\/chat\/completions HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950316:lfi-14", "950468:nosqli-3", "http_llm_api_scrape" ] }
12/10/2026 12:49:35 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /api/generate	Élevée	Moyen · 45
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /api/generate UA WebSiphon/next-0.1 Émulateur HTTP WAF 10 Recommandation Surveiller Tags 950468:nosqli-3 950600:k8s-api http_llm_api_scrape http_probe_api Cible HTTP GET /api/generate TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /api/generate Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, k8s-api · confiance 52% Confiance classification 52% Risque capteur Moyen · 45 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /api/generate HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 k8s-api Payload (extrait) GET /api/generate HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "936860dc47fddfa29c2a5870be08eee8d872b4b2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 132, "payload_entropy": 5.053504446101963, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 48, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 10, "risk_granularity": 2.5, "risk_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "3382b1e96308cfce08ae00a4b8041d6d2d705892", "event_fingerprint": "b4bbf3a5877c0d4365730ad8c5d88d3127d12f9b", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "343e94206178035fa6bdd208ef053bbb", "path_pattern_hash": "b2719b326a710ce2c7b0df9420262e47" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/api\/generate HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "method": "GET", "path": "\/api\/generate", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/generate HTTP\/1.1", "request_sample": "GET \/api\/generate HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/generate HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/api\/generate", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/generate HTTP\/1.1", "request_sample": "GET \/api\/generate HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/generate HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "517806f35589ef20b8a8ef1418b33f5578af6733", "protocol_details": { "http_method": "GET", "http_path": "\/api\/generate", "request_line": "GET \/api\/generate HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/generate HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/generate", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 45 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/generate", "request_line": "GET \/api\/generate HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/generate", "evidence_snippet": "GET \/api\/generate HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "950600:k8s-api", "http_llm_api_scrape", "http_probe_api" ] }
12/10/2026 12:49:35 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /version	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /version UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /version TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /version Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Motifs de détection (base) Docker API version etcd version Ligne de requête `GET /version HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /version HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "76c5a6fe5f8bec907b8dcab1abdf135058b50bc3", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 127, "payload_entropy": 5.123477679614973, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "23b1c5d31f6c345140a880d73e8e1b76de7a7999", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "matched_patterns": [ "pat-0522", "pat-0525" ], "matched_pattern_names": [ "Docker API version", "etcd version" ], "pattern_ids": [ "pat-0522", "pat-0525" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "4be91966c9f093632d3dba5c3c137750", "path_pattern_hash": "c77d9d7f66686362a33d6f2622fa5690" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/version HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/version", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/version HTTP\/1.1", "request_sample": "GET \/version HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/version HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/version", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/version HTTP\/1.1", "request_sample": "GET \/version HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/version HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d41da9e8a2a35e831bbd5646806420304c1e42e4", "protocol_details": { "http_method": "GET", "http_path": "\/version", "request_line": "GET \/version HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/version HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/version", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/version", "request_line": "GET \/version HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/version", "evidence_snippet": "GET \/version HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_monitor" }
12/10/2026 12:49:35 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /info	Faible	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /info UA WebSiphon/next-0.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP GET /info TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /info Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance modérée (52 %) — signal principal unique Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /info HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF — Payload (extrait) GET /info HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "5338ec2703ace1fbfb779d6e11e562e8cf7fc325", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 124, "payload_entropy": 5.109990189671201, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 8, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f", "event_fingerprint": "dc51bcc45e520e5b979f606342362d40e5d2b836", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "c218adcecaf58f3f27402c4a9e5e6ea0", "path_pattern_hash": "52b3cc6e4f000c70a79583bf814cc5de" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/info HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/info", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/info HTTP\/1.1", "request_sample": "GET \/info HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/info HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/info", "user_agent": "WebSiphon\/next-0.1", "request_line": "GET \/info HTTP\/1.1", "request_sample": "GET \/info HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/info HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "40ebe7e8ec7a5178cac96cf6619ff6e9fc441cfd", "protocol_details": { "http_method": "GET", "http_path": "\/info", "request_line": "GET \/info HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/info HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/info", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 8, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/info", "request_line": "GET \/info HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/info", "evidence_snippet": "GET \/info HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:9400 · (tentative d'exploit) · → /v1/models	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /v1/models UA WebSiphon/next-0.1 Émulateur HTTP WAF 14 Recommandation Surveiller Tags 950316:lfi-14 950468:nosqli-3 Cible HTTP GET /v1/models TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /v1/models Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 45 Confiance : Confiance 59 % — 2 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /v1/models HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF lfi-14 nosqli-3 Payload (extrait) GET /v1/models HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "b4dbc0e5f8d08267b3350ec2235f7776deb82823", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 129, "payload_entropy": 5.161686202295268, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 64, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "2f5fc45296eeff024ea05781621dba25fab698f3", "event_fingerprint": "83b9fa6d0ea30985f7f9e6735816bcb5f60cd714", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "confidence_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "bee1263fcec2ba5e0f1f1b9d224d8515", "path_pattern_hash": "d7b0903584595062c9a8a7bf8cc51283" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/v1\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r", "method": "GET", "path": "\/v1\/models", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3" ], "waf_rule_names": [ "lfi-14", "nosqli-3" ], "request_line": "GET \/v1\/models HTTP\/1.1", "request_sample": "GET \/v1\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/v1\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/v1\/models", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3" ], "waf_rule_names": [ "lfi-14", "nosqli-3" ], "request_line": "GET \/v1\/models HTTP\/1.1", "request_sample": "GET \/v1\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/v1\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3a5000b3d83a7001686250c8edc110c573832e2d", "protocol_details": { "http_method": "GET", "http_path": "\/v1\/models", "request_line": "GET \/v1\/models HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/v1\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/models", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 64, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/v1\/models", "request_line": "GET \/v1\/models HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v1\/models", "evidence_snippet": "GET \/v1\/models HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950316:lfi-14", "950468:nosqli-3" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /api/tags	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /api/tags UA WebSiphon/next-0.1 Émulateur HTTP WAF 10 Recommandation Surveiller Tags 950468:nosqli-3 950600:k8s-api http_probe_api Cible HTTP GET /api/tags TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /api/tags Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, k8s-api · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /api/tags HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 k8s-api Payload (extrait) GET /api/tags HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "cde412588e4eb9223c5fe3ed29cd50624af6b3d6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 128, "payload_entropy": 5.090569708247709, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 48, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8b165c229a7304406256b9c81a47c20ae5f7c23d", "event_fingerprint": "5d388a0dc536e7833260b7d760bfdb88643b9bf6", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "6f530960f2316680dcfa0c726fc126b9", "path_pattern_hash": "0b9689ff0de7d3cfbe6f81aa48fb9f18" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/api\/tags HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/api\/tags", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/tags HTTP\/1.1", "request_sample": "GET \/api\/tags HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/tags HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/api\/tags", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/tags HTTP\/1.1", "request_sample": "GET \/api\/tags HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/tags HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12ef23852180c6bacac2f61b1061de6fb6f49000", "protocol_details": { "http_method": "GET", "http_path": "\/api\/tags", "request_line": "GET \/api\/tags HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/tags HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/tags", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/tags", "request_line": "GET \/api\/tags HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/tags", "evidence_snippet": "GET \/api\/tags HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "950600:k8s-api", "http_probe_api" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /api/cluster_status	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /api/cluster_status UA WebSiphon/next-0.1 Émulateur HTTP WAF 10 Recommandation Surveiller Tags 950468:nosqli-3 950600:k8s-api http_probe_api Cible HTTP GET /api/cluster_status TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /api/cluster_status Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3, k8s-api · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /api/cluster_status HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 k8s-api Payload (extrait) GET /api/cluster_status HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.3 Requête brute (extrait) GET /api/cluster_status HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "9586c43142a9300d641bacc0b8ea7ac5b50f4ad0", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 138, "payload_entropy": 5.1158112404925316, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 48, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.2, "risk_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8b165c229a7304406256b9c81a47c20ae5f7c23d", "event_fingerprint": "37b5cb1544d28a1c2309da844b8c1b1afa437d35", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "a36e7f82184845f063e733a80af1b5f9", "path_pattern_hash": "4c39ba3880002ae3f6cecbe2126a9f88" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/api\/cluster_status HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "method": "GET", "path": "\/api\/cluster_status", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/cluster_status HTTP\/1.1", "request_sample": "GET \/api\/cluster_status HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/cluster_status HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "evidence": { "method": "GET", "path": "\/api\/cluster_status", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/cluster_status HTTP\/1.1", "request_sample": "GET \/api\/cluster_status HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/cluster_status HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8d09b06c04211c8ae561ae5bb61a8a739101623b", "protocol_details": { "http_method": "GET", "http_path": "\/api\/cluster_status", "request_line": "GET \/api\/cluster_status HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/cluster_status HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/cluster_status", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3, k8s-api \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 48, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/cluster_status", "request_line": "GET \/api\/cluster_status HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/cluster_status", "evidence_snippet": "GET \/api\/cluster_status HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 48 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "950600:k8s-api", "http_probe_api" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:9400 · (tentative d'exploit) · → /api/v1/pods	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /api/v1/pods UA WebSiphon/next-0.1 Émulateur HTTP WAF 18 Recommandation Investiguer Tags 950316:lfi-14 950468:nosqli-3 950600:k8s-api http_api_route_probe Cible HTTP GET /api/v1/pods TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /api/v1/pods Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 50 Confiance : Confiance 59 % — 3 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /api/v1/ Ligne de requête `GET /api/v1/pods HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF lfi-14 nosqli-3 k8s-api Payload (extrait) GET /api/v1/pods HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "1c60012ee359e94b9b449a8f2f901950cca553db", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 131, "payload_entropy": 5.123762677689303, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 80, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 80, "classification": 78, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 50, "tag_count": 6, "anomaly_count": 0, "campaign_key": "b0c32d0af41c94472847d14557ff477ddfacc0ba", "event_fingerprint": "0ec684294bebf28b7251147f62398c29a975988f", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "matched_patterns": [ "pat-0212" ], "matched_pattern_names": [ "Probe \/api\/v1\/" ], "pattern_ids": [ "pat-0212" ], "confidence_breakdown": { "waf": 80, "classification": 78, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "8452d1eb54de4b1c856f841be6533b37", "path_pattern_hash": "804ce97b3ae15ff0e7f5ae5f1b827112" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/api\/v1\/pods HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r", "method": "GET", "path": "\/api\/v1\/pods", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "lfi-14", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/v1\/pods HTTP\/1.1", "request_sample": "GET \/api\/v1\/pods HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/v1\/pods HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/api\/v1\/pods", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "lfi-14", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/v1\/pods HTTP\/1.1", "request_sample": "GET \/api\/v1\/pods HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/v1\/pods HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c53c9ab88d576440225ea8c8e4b47c69dd51dced", "protocol_details": { "http_method": "GET", "http_path": "\/api\/v1\/pods", "request_line": "GET \/api\/v1\/pods HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/v1\/pods HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v1\/pods", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 80, "classification": 78, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 50 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/v1\/pods", "request_line": "GET \/api\/v1\/pods HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v1\/pods", "evidence_snippet": "GET \/api\/v1\/pods HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 80 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950316:lfi-14", "950468:nosqli-3", "950600:k8s-api", "http_api_route_probe", "http_k8s_probe", "http_probe_api" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /dcgm/metrics	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /dcgm/metrics UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_prometheus_probe Cible HTTP GET /dcgm/metrics TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /dcgm/metrics Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /dcgm/metrics HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /dcgm/metrics HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "49abc645d1fac2f56f634b2d297cb41aa6ac4a87", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 132, "payload_entropy": 5.123718083103028, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 2, "anomaly_count": 0, "campaign_key": "77eda7529d27778150aab6756dea025f99f393dc", "event_fingerprint": "1f731ed43a6c02a808757f4467c1d924f601afca", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "5980f108646a2283414901d864051b7f", "path_pattern_hash": "d3222ab3da69e3290a00dc521ec63886" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/dcgm\/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "method": "GET", "path": "\/dcgm\/metrics", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/dcgm\/metrics HTTP\/1.1", "request_sample": "GET \/dcgm\/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/dcgm\/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/dcgm\/metrics", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/dcgm\/metrics HTTP\/1.1", "request_sample": "GET \/dcgm\/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/dcgm\/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9f150e2a7ed68be215b742b288496d066b56088b", "protocol_details": { "http_method": "GET", "http_path": "\/dcgm\/metrics", "request_line": "GET \/dcgm\/metrics HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/dcgm\/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/dcgm\/metrics", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/dcgm\/metrics", "request_line": "GET \/dcgm\/metrics HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/dcgm\/metrics", "evidence_snippet": "GET \/dcgm\/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_prometheus_probe" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:9400 · (tentative d'exploit) · → /api/v1/nodes	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /api/v1/nodes UA WebSiphon/next-0.1 Émulateur HTTP WAF 18 Recommandation Investiguer Tags 950316:lfi-14 950468:nosqli-3 950600:k8s-api http_api_route_probe Cible HTTP GET /api/v1/nodes TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /api/v1/nodes Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 50 Confiance : Confiance 59 % — 3 tag(s) WAF Signaux CRS-930100-sub Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /api/v1/ Ligne de requête `GET /api/v1/nodes HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF lfi-14 nosqli-3 k8s-api Payload (extrait) GET /api/v1/nodes HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "23801e0aa6e349eb1dd52e0e2094cd558b9de264", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 132, "payload_entropy": 5.113670949964512, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 80, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 80, "classification": 78, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 50, "tag_count": 6, "anomaly_count": 0, "campaign_key": "b0c32d0af41c94472847d14557ff477ddfacc0ba", "event_fingerprint": "cc08340e0532d433d2c16efb58b10e36afe5b099", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "CRS-930100-sub" ], "kb_rule_ids": [ "CRS-930100-sub" ], "matched_patterns": [ "pat-0212" ], "matched_pattern_names": [ "Probe \/api\/v1\/" ], "pattern_ids": [ "pat-0212" ], "confidence_breakdown": { "waf": 80, "classification": 78, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "e0a441ef7b07a74d2c8072953538cec8", "path_pattern_hash": "0ce41973e9736d201c0150cbc320cc41" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/api\/v1\/nodes HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "method": "GET", "path": "\/api\/v1\/nodes", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "lfi-14", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/v1\/nodes HTTP\/1.1", "request_sample": "GET \/api\/v1\/nodes HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/v1\/nodes HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/api\/v1\/nodes", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950316:lfi-14", "950468:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "lfi-14", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/v1\/nodes HTTP\/1.1", "request_sample": "GET \/api\/v1\/nodes HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/api\/v1\/nodes HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "300c9ff41bf9ff8b4789d05afc638259c882d6df", "protocol_details": { "http_method": "GET", "http_path": "\/api\/v1\/nodes", "request_line": "GET \/api\/v1\/nodes HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/v1\/nodes HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v1\/nodes", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 80, "classification": 78, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 50 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "CRS-930100-sub" ], "tags_summary_labels_fr": [ "CRS-930100-sub" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/v1\/nodes", "request_line": "GET \/api\/v1\/nodes HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v1\/nodes", "evidence_snippet": "GET \/api\/v1\/nodes HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 80 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950316:lfi-14", "950468:nosqli-3", "950600:k8s-api", "http_api_route_probe", "http_k8s_probe", "http_probe_api" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Sonde Prometheus prometheus probe · via HTTP:9400 · (sonde / probe) · → /metrics	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /metrics UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950601:k8s-metrics 950610:prometheus-metrics http_probe_metrics http_prometheus_probe Cible HTTP GET /metrics TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /metrics Service HTTP Pourquoi cette classification : Tags WAF: k8s-metrics, prometheus-metrics · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF Signaux Sonde métriques Prometheus Upstream Tag WAF SQLi (métriques) Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Probe /metrics Ligne de requête `GET /metrics HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF k8s-metrics prometheus-metrics Payload (extrait) GET /metrics HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "7edfc244708a7b5c7d4b4385c178aa8e03afde7f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 127, "payload_entropy": 5.116417861093401, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 32, "classification": 48, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "45066e666676e29aa4303585e87c0031aafcf0f9", "event_fingerprint": "3c087d0c370d16df9c005fa74b13ef8a749a0346", "classification_reason": "Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 87, "precision_signals": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "kb_rule_ids": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "matched_patterns": [ "pat-0266" ], "matched_pattern_names": [ "Probe \/metrics" ], "pattern_ids": [ "pat-0266" ], "confidence_breakdown": { "waf": 32, "classification": 48, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "340d0b4f21f3e0fff4b9abf41aaac14e", "path_pattern_hash": "b4bbca6caf5247626ee41b68231d40e1" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "method": "GET", "path": "\/metrics", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "evidence": { "method": "GET", "path": "\/metrics", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950601:k8s-metrics", "950610:prometheus-metrics" ], "waf_rule_names": [ "k8s-metrics", "prometheus-metrics" ], "request_line": "GET \/metrics HTTP\/1.1", "request_sample": "GET \/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "classification_reason": "Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0657af239aa3bee87182fffa7da07e5280b53e40", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "attack_vector": "prometheus probe \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%", "classification_reason_label_fr": "Tags WAF: k8s-metrics, prometheus-metrics \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 32, "classification": 48, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-benign-metrics", "INT-upstream", "INT-sqli-tag-only-metrics" ], "tags_summary_labels_fr": [ "Sonde m\u00e9triques Prometheus", "Upstream", "Tag WAF SQLi (m\u00e9triques)" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/metrics", "request_line": "GET \/metrics HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "prometheus probe \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/metrics", "evidence_snippet": "GET \/metrics HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950601:k8s-metrics", "950610:prometheus-metrics", "http_probe_metrics", "http_prometheus_probe" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /docker/daemon.json	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /docker/daemon.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 Cible HTTP GET /docker/daemon.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /docker/daemon.json Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /docker/daemon.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /docker/daemon.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.3 Requête brute (extrait) GET /docker/daemon.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "e5271a3b656cf000a7280017cc0bbb0af3043832", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 138, "payload_entropy": 5.14372968337005, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 1, "anomaly_count": 0, "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf", "event_fingerprint": "d8421a812685c3bc268b3ff44dfc4b8387615b60", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "a7659fb909490f3d2d3645dc1a7f0b77", "path_pattern_hash": "d40df599f49285dfc3e30ec64684f4e4" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "method": "GET", "path": "\/docker\/daemon.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/docker\/daemon.json HTTP\/1.1", "request_sample": "GET \/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "evidence": { "method": "GET", "path": "\/docker\/daemon.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/docker\/daemon.json HTTP\/1.1", "request_sample": "GET \/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d640126a751b2b4ceb06dbdba7677cea388b0cd0", "protocol_details": { "http_method": "GET", "http_path": "\/docker\/daemon.json", "request_line": "GET \/docker\/daemon.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/docker\/daemon.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/docker\/daemon.json", "request_line": "GET \/docker\/daemon.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/docker\/daemon.json", "evidence_snippet": "GET \/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /.docker/daemon.json	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /.docker/daemon.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 Cible HTTP GET /.docker/daemon.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /.docker/daemon.json Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /.docker/daemon.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /.docker/daemon.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50. Requête brute (extrait) GET /.docker/daemon.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "0e0eeb19aa6f34bc94aa147b3b3ec239a86ccafa", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 139, "payload_entropy": 5.138485042648715, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 1, "anomaly_count": 0, "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf", "event_fingerprint": "5b284ec2ae0324a37b0496360d14c5c0d89b7f30", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "71897b075b0af97128cb1c136132a504", "path_pattern_hash": "12b7d093cc60fed09d661d8bd82a2072" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/.docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "method": "GET", "path": "\/.docker\/daemon.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.docker\/daemon.json HTTP\/1.1", "request_sample": "GET \/.docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "evidence": { "method": "GET", "path": "\/.docker\/daemon.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/.docker\/daemon.json HTTP\/1.1", "request_sample": "GET \/.docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/.docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "def382f8337ea919c2338fa0c8c1b5a70a427b07", "protocol_details": { "http_method": "GET", "http_path": "\/.docker\/daemon.json", "request_line": "GET \/.docker\/daemon.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.docker\/daemon.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.docker\/daemon.json", "request_line": "GET \/.docker\/daemon.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.docker\/daemon.json", "evidence_snippet": "GET \/.docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /etc/docker/daemon.json	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /etc/docker/daemon.json UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 Cible HTTP GET /etc/docker/daemon.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /etc/docker/daemon.json Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /etc/docker/daemon.json HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /etc/docker/daemon.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3. Requête brute (extrait) GET /etc/docker/daemon.json HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "json", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "eb76a516b1ad5347fe2ab5a24a8028bfdd006bbb", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 142, "payload_entropy": 5.119528567645482, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.5, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 37, "tag_count": 1, "anomaly_count": 0, "campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf", "event_fingerprint": "e520223d706c369b9d342adebdaa8606deb2e326", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "50a83f0917f718d6ec0fcba84fdc8c9c", "path_pattern_hash": "5a7b8c1bcffb2a0fedba8c9f4ff76217" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/etc\/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "method": "GET", "path": "\/etc\/docker\/daemon.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/etc\/docker\/daemon.json HTTP\/1.1", "request_sample": "GET \/etc\/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/etc\/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "evidence": { "method": "GET", "path": "\/etc\/docker\/daemon.json", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/etc\/docker\/daemon.json HTTP\/1.1", "request_sample": "GET \/etc\/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/etc\/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "48249b79e8760a0053bc94dc74fcf03ecb830ac0", "protocol_details": { "http_method": "GET", "http_path": "\/etc\/docker\/daemon.json", "request_line": "GET \/etc\/docker\/daemon.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/etc\/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/docker\/daemon.json", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/etc\/docker\/daemon.json", "request_line": "GET \/etc\/docker\/daemon.json HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/etc\/docker\/daemon.json", "evidence_snippet": "GET \/etc\/docker\/daemon.json HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3" ] }
12/10/2026 12:49:34 UTC	TCP	9400 · HTTP	http	Scan de ports port scan syn · via HTTP:9400 · (reconnaissance) · → /ansible/ansible.cfg	Élevée	Faible · 37
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0043 TA0043 Protocole GET /ansible/ansible.cfg UA WebSiphon/next-0.1 Émulateur HTTP WAF 6 Recommandation Surveiller Tags 950468:nosqli-3 http_probe_ansible Cible HTTP GET /ansible/ansible.cfg TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9400 Chemin / cible /ansible/ansible.cfg Service HTTP Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52% Confiance classification 52% Risque capteur Faible · 37 Confiance : Confiance 52 % — 1 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /ansible/ansible.cfg HTTP/1.1` User-Agent WebSiphon/next-0.1 Règles WAF nosqli-3 Payload (extrait) GET /ansible/ansible.cfg HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50. Requête brute (extrait) GET /ansible/ansible.cfg HTTP/1.1 accept: / user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400 Meta JSON brut { "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "cfg", "http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524", "http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303", "http_target_hash": "dbdd6170917ed95debd9bca628f207608fe4053d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 139, "payload_entropy": 5.092812268939385, "port_category": "registered", "org": "Oracle Corporation", "service": "http", "app_proto": "http", "asn": 31898, "country": "SG", "dst_port": 9400, "risk_waf": 32, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 37, "tag_count": 2, "anomaly_count": 0, "campaign_key": "956fa1a51c233d1191601d2c0353360037419c2f", "event_fingerprint": "6bc8b4c16054e5740f10ac738fe7ec42ddbf0c1b", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "confidence": 0.52, "classification_confidence": 0.52, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 31898, "org": "Oracle Corporation", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141", "payload_hash": "a71ba6bb38c68d4e70774e5a8477c7af", "path_pattern_hash": "37b86c014c6f7f09c95869c631a4afca" }, "target_context": { "dst_port": 9400, "service": "http", "service_name": "http", "risk_score": 37 }, "payload_preview": "GET \/ansible\/ansible.cfg HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "method": "GET", "path": "\/ansible\/ansible.cfg", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/ansible\/ansible.cfg HTTP\/1.1", "request_sample": "GET \/ansible\/ansible.cfg HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ansible\/ansible.cfg HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "evidence": { "method": "GET", "path": "\/ansible\/ansible.cfg", "user_agent": "WebSiphon\/next-0.1", "waf_tags": [ "950468:nosqli-3" ], "waf_rule_names": [ "nosqli-3" ], "request_line": "GET \/ansible\/ansible.cfg HTTP\/1.1", "request_sample": "GET \/ansible\/ansible.cfg HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n", "payload_snippet": "GET \/ansible\/ansible.cfg HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dda66f2e01d61e060fae2fb7406826ccf71b1012", "protocol_details": { "http_method": "GET", "http_path": "\/ansible\/ansible.cfg", "request_line": "GET \/ansible\/ansible.cfg HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ansible\/ansible.cfg HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/ansible.cfg", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP", "confidence_pct": 52, "confidence_breakdown": { "waf": 32, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 37 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 37, "risk_label": "Faible", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9400, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/ansible\/ansible.cfg", "request_line": "GET \/ansible\/ansible.cfg HTTP\/1.1", "http_user_agent": "WebSiphon\/next-0.1", "port": 9400, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/ansible\/ansible.cfg", "evidence_snippet": "GET \/ansible\/ansible.cfg HTTP\/1.1\r\naccept: \/\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.", "target_port_label": "9400 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF", "confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9400" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950468:nosqli-3", "http_probe_ansible" ] }

161.118.232.74

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence