|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /wrangler.toml
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /wrangler.toml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/wrangler.toml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/wrangler.toml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /wrangler.toml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /wrangler.toml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:940
Requête brute (extrait)
GET /wrangler.toml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "toml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "9cdb494583727e2042881749161dbc1289db1b0f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 133,
"payload_entropy": 5.1471780230109445,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "a31cb4963a314264d7048a670355c530c85f4106",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "7087b06308612ee5da08d4e471760bb6",
"path_pattern_hash": "114585c9a2f46701943ef64a662f8940"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/wrangler.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"method": "GET",
"path": "\/wrangler.toml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/wrangler.toml HTTP\/1.1",
"request_sample": "GET \/wrangler.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/wrangler.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"evidence": {
"method": "GET",
"path": "\/wrangler.toml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/wrangler.toml HTTP\/1.1",
"request_sample": "GET \/wrangler.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/wrangler.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2358aadd5df50869d9926d27e4c516d9aba84d75",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wrangler.toml",
"request_line": "GET \/wrangler.toml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wrangler.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/wrangler.toml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wrangler.toml",
"request_line": "GET \/wrangler.toml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/wrangler.toml",
"evidence_snippet": "GET \/wrangler.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /fly.toml
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /fly.toml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/fly.toml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/fly.toml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /fly.toml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /fly.toml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "toml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "8dc7ca0498c0b90b175835b98d90d8ab97127fcd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 128,
"payload_entropy": 5.169273098256669,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "274ad70bb51a3576a95a54b3f0871a1088af661b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "085568691ec71d580e3d9ad2273ea34e",
"path_pattern_hash": "b472e203e3c4abd0d801d16de728cc79"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/fly.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"method": "GET",
"path": "\/fly.toml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/fly.toml HTTP\/1.1",
"request_sample": "GET \/fly.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/fly.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/fly.toml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/fly.toml HTTP\/1.1",
"request_sample": "GET \/fly.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/fly.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d985aa50623103e2d1c1d49c95fcc23ad076412",
"protocol_details": {
"http_method": "GET",
"http_path": "\/fly.toml",
"request_line": "GET \/fly.toml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/fly.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/fly.toml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/fly.toml",
"request_line": "GET \/fly.toml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/fly.toml",
"evidence_snippet": "GET \/fly.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /render.yaml
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /render.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/render.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/render.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /render.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /render.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "acb66552eb13d3404831c7e462882b8f083e4828",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.140442701754321,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "8a66e350f3f4405cd43501b082ff0c64f066d59a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "db8c4f216eb8d2e5716a2389f5c42dc8",
"path_pattern_hash": "f571f6764ed015a7a02871ec39e52759"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/render.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
"method": "GET",
"path": "\/render.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/render.yaml HTTP\/1.1",
"request_sample": "GET \/render.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/render.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/render.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/render.yaml HTTP\/1.1",
"request_sample": "GET \/render.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/render.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9844a09fa4d0cc7524e541d06eb3f24622f7402b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/render.yaml",
"request_line": "GET \/render.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/render.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/render.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/render.yaml",
"request_line": "GET \/render.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/render.yaml",
"evidence_snippet": "GET \/render.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:9400 · (sonde / probe) · → /vercel.json
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /vercel.json UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/vercel.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/vercel.json
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 5
Confiance : Confiance 55 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /vercel.json HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /vercel.json HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "5bd1b41f28fd4278621445f88a07d3885661d6d5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.1382251898806315,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "71d80a47aecdfd69e01c559bc949929fecf16112",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "73b758d3219f7074ed126718e63109aa",
"path_pattern_hash": "b483158fec074f023f0eff6f93024c73"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 5
},
"payload_preview": "GET \/vercel.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
"method": "GET",
"path": "\/vercel.json",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/vercel.json HTTP\/1.1",
"request_sample": "GET \/vercel.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/vercel.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/vercel.json",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/vercel.json HTTP\/1.1",
"request_sample": "GET \/vercel.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/vercel.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.55,
"classification_confidence": 0.55,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f53593cde1bff8b4571147487113c8df75e9dde",
"protocol_details": {
"http_method": "GET",
"http_path": "\/vercel.json",
"request_line": "GET \/vercel.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/vercel.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/vercel.json",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 5,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/vercel.json",
"request_line": "GET \/vercel.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/vercel.json",
"evidence_snippet": "GET \/vercel.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:9400 · (sonde / probe) · → /netlify.toml
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /netlify.toml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/netlify.toml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/netlify.toml
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 5
Confiance : Confiance 55 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /netlify.toml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /netlify.toml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "toml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "59e17fedeca585e2e06d93bc32da520287aec48d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 132,
"payload_entropy": 5.146539862295099,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "3b6db17ff3a92d35c0d3f65990e4a4171f8c731d",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "556f2604025b204e1875ca22df4c5b79",
"path_pattern_hash": "836d7c07f24751ab3f69c69c10e0e6fa"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 5
},
"payload_preview": "GET \/netlify.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"method": "GET",
"path": "\/netlify.toml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/netlify.toml HTTP\/1.1",
"request_sample": "GET \/netlify.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/netlify.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/netlify.toml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/netlify.toml HTTP\/1.1",
"request_sample": "GET \/netlify.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/netlify.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.55,
"classification_confidence": 0.55,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c11c606bd61cfbb5ba0e0ae3f65ac8cfa74eb31c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/netlify.toml",
"request_line": "GET \/netlify.toml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/netlify.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/netlify.toml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 5,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/netlify.toml",
"request_line": "GET \/netlify.toml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/netlify.toml",
"evidence_snippet": "GET \/netlify.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:9400 · (sonde / probe) · → /samconfig.toml
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /samconfig.toml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/samconfig.toml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/samconfig.toml
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 5
Confiance : Confiance 55 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /samconfig.toml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /samconfig.toml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:94
Requête brute (extrait)
GET /samconfig.toml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "toml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "0d1448e8cb128b7ac98dba13ff91275c047467a0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 134,
"payload_entropy": 5.141889052939314,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "64a0d27d2822f60d5dfe553d774ea6daab1785c5",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "3e329d1de2d39a92d1b0d6213f040baf",
"path_pattern_hash": "a64496fc979bbc31d783494b74fd1356"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 5
},
"payload_preview": "GET \/samconfig.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"method": "GET",
"path": "\/samconfig.toml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/samconfig.toml HTTP\/1.1",
"request_sample": "GET \/samconfig.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/samconfig.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"evidence": {
"method": "GET",
"path": "\/samconfig.toml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/samconfig.toml HTTP\/1.1",
"request_sample": "GET \/samconfig.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/samconfig.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.55,
"classification_confidence": 0.55,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "841f89557aa02fb87ed9c6be3cf839a9d7c7c82f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/samconfig.toml",
"request_line": "GET \/samconfig.toml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/samconfig.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/samconfig.toml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 5,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/samconfig.toml",
"request_line": "GET \/samconfig.toml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/samconfig.toml",
"evidence_snippet": "GET \/samconfig.toml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:9400 · (sonde / probe) · → /template.yaml
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /template.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/template.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/template.yaml
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 5
Confiance : Confiance 55 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /template.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /template.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:940
Requête brute (extrait)
GET /template.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "29198dffdd7c8169b4e7546fb37a4e2ed7d94faa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 133,
"payload_entropy": 5.129866760751567,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "e0db0f607d2ab00793c46e52907667c028e64590",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "fcf90622134e8f15e8ef8733dc723db4",
"path_pattern_hash": "980bef05c4b4f29c0023c27e120dd57a"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 5
},
"payload_preview": "GET \/template.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"method": "GET",
"path": "\/template.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/template.yaml HTTP\/1.1",
"request_sample": "GET \/template.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/template.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"evidence": {
"method": "GET",
"path": "\/template.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/template.yaml HTTP\/1.1",
"request_sample": "GET \/template.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/template.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.55,
"classification_confidence": 0.55,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7deca444f83fcf30320fa8551240908c14965507",
"protocol_details": {
"http_method": "GET",
"http_path": "\/template.yaml",
"request_line": "GET \/template.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/template.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/template.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 5,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/template.yaml",
"request_line": "GET \/template.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/template.yaml",
"evidence_snippet": "GET \/template.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:9400 · (sonde / probe) · → /cdk.context.json
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /cdk.context.json UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/cdk.context.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/cdk.context.json
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 5
Confiance : Confiance 55 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /cdk.context.json HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /cdk.context.json HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:
Requête brute (extrait)
GET /cdk.context.json HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "846fa70cafb4e83c728dbf7d1d24a1d8b7bfc46a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 136,
"payload_entropy": 5.117158133226473,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "43caf2d9d5500082bbeba4458d3fc90a077416f2",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "2676d4f91824c3fc7d86dd529e4cafbe",
"path_pattern_hash": "8522585bb7a9165df4c44bdcff2234d3"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 5
},
"payload_preview": "GET \/cdk.context.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"method": "GET",
"path": "\/cdk.context.json",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/cdk.context.json HTTP\/1.1",
"request_sample": "GET \/cdk.context.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/cdk.context.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"evidence": {
"method": "GET",
"path": "\/cdk.context.json",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/cdk.context.json HTTP\/1.1",
"request_sample": "GET \/cdk.context.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/cdk.context.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.55,
"classification_confidence": 0.55,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b074281b0df1778c9d31a24762808c9686bc14e5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cdk.context.json",
"request_line": "GET \/cdk.context.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cdk.context.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cdk.context.json",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 5,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cdk.context.json",
"request_line": "GET \/cdk.context.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cdk.context.json",
"evidence_snippet": "GET \/cdk.context.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9400 · (sonde / probe) · → /cdk.out/manifest.json
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /cdk.out/manifest.json UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/cdk.out/manifest.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/cdk.out/manifest.json
Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 68%
Confiance classification
68%
Risque capteur
Moyen
· 40
Confiance : Confiance 68 % — Score WAF 32 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /cdk.out/manifest.json HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /cdk.out/manifest.json HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.5
Requête brute (extrait)
GET /cdk.out/manifest.json HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "140dd89339f332cdc5a3bf2c48c7aec08fb4e3fa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 141,
"payload_entropy": 5.157074495762508,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "45e4d7e3bf910a78e7776d6735f0ab31c4fc07a0",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "8bc24db068535b50640a85c9a04ffc58",
"path_pattern_hash": "f7e6c8dd14113d478101af044eab15d3"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/cdk.out\/manifest.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
"method": "GET",
"path": "\/cdk.out\/manifest.json",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/cdk.out\/manifest.json HTTP\/1.1",
"request_sample": "GET \/cdk.out\/manifest.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/cdk.out\/manifest.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
"evidence": {
"method": "GET",
"path": "\/cdk.out\/manifest.json",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/cdk.out\/manifest.json HTTP\/1.1",
"request_sample": "GET \/cdk.out\/manifest.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/cdk.out\/manifest.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%"
},
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%",
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.68,
"classification_confidence": 0.68,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31fd27ee28f5dcd2d3de3e22c59490e9941479cc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cdk.out\/manifest.json",
"request_line": "GET \/cdk.out\/manifest.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cdk.out\/manifest.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cdk.out\/manifest.json",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%",
"classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cdk.out\/manifest.json",
"request_line": "GET \/cdk.out\/manifest.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cdk.out\/manifest.json",
"evidence_snippet": "GET \/cdk.out\/manifest.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.5",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9400 · (sonde / probe) · → /.serverless/serverless-state.json
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /.serverless/serverless-state.json UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/.serverless/serverless-state.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.serverless/serverless-state.json
Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 68%
Confiance classification
68%
Risque capteur
Moyen
· 40
Confiance : Confiance 68 % — Score WAF 32 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /.serverless/serverless-state.json HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /.serverless/serverless-state.json HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
Requête brute (extrait)
GET /.serverless/serverless-state.json HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "833d724489be45f09973d3d9ee4106616b8f51e8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 153,
"payload_entropy": 5.052240605204809,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "a6598b9a0c01cb07740b50ecf9c4e43496b6d53d",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "ee33ae37f242d026a60301a51f3933d8",
"path_pattern_hash": "5bd235129ced9798014e94e63ba97684"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/.serverless\/serverless-state.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\n",
"method": "GET",
"path": "\/.serverless\/serverless-state.json",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.serverless\/serverless-state.json HTTP\/1.1",
"request_sample": "GET \/.serverless\/serverless-state.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.serverless\/serverless-state.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
"evidence": {
"method": "GET",
"path": "\/.serverless\/serverless-state.json",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.serverless\/serverless-state.json HTTP\/1.1",
"request_sample": "GET \/.serverless\/serverless-state.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.serverless\/serverless-state.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%"
},
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%",
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.68,
"classification_confidence": 0.68,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e3d21baba3a91d6ff5144b569f3ffa0b09a1b9b1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.serverless\/serverless-state.json",
"request_line": "GET \/.serverless\/serverless-state.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.serverless\/serverless-state.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.serverless\/serverless-state.json",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%",
"classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.serverless\/serverless-state.json",
"request_line": "GET \/.serverless\/serverless-state.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.serverless\/serverless-state.json",
"evidence_snippet": "GET \/.serverless\/serverless-state.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /serverless.yaml
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /serverless.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/serverless.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/serverless.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /serverless.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /serverless.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9
Requête brute (extrait)
GET /serverless.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "20fa0af813635ad0a35851be2ee30a3c843c4ea6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 135,
"payload_entropy": 5.160847245793201,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "1a69e8806dff5167f5383b500418e0590cbe56e5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "d69bc6b58ddf05c13906cefa1bd0f611",
"path_pattern_hash": "ee0bed76f96369bfa82cc3ee3c740180"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/serverless.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"method": "GET",
"path": "\/serverless.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/serverless.yaml HTTP\/1.1",
"request_sample": "GET \/serverless.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/serverless.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"evidence": {
"method": "GET",
"path": "\/serverless.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/serverless.yaml HTTP\/1.1",
"request_sample": "GET \/serverless.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/serverless.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f12687688e46abc9ebe744758beee279a4c304ec",
"protocol_details": {
"http_method": "GET",
"http_path": "\/serverless.yaml",
"request_line": "GET \/serverless.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/serverless.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/serverless.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/serverless.yaml",
"request_line": "GET \/serverless.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/serverless.yaml",
"evidence_snippet": "GET \/serverless.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /Pulumi.prod.yaml
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /Pulumi.prod.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/Pulumi.prod.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/Pulumi.prod.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /Pulumi.prod.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /Pulumi.prod.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:
Requête brute (extrait)
GET /Pulumi.prod.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "e073179f44c1fb861e71691db9ffa7769daa0fc5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 136,
"payload_entropy": 5.1973003458360205,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "7e8e7c4a50dc03c5361db5ad0c956188cf2e1831",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "d51a64bca6cabcbceee672b7caf965d5",
"path_pattern_hash": "5639c8a128d5c79f12d99bfaeb7666e3"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/Pulumi.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"method": "GET",
"path": "\/Pulumi.prod.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/Pulumi.prod.yaml HTTP\/1.1",
"request_sample": "GET \/Pulumi.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/Pulumi.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"evidence": {
"method": "GET",
"path": "\/Pulumi.prod.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/Pulumi.prod.yaml HTTP\/1.1",
"request_sample": "GET \/Pulumi.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/Pulumi.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68528b7df808a862ce58d7a7f9273ee369588780",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Pulumi.prod.yaml",
"request_line": "GET \/Pulumi.prod.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Pulumi.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/Pulumi.prod.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/Pulumi.prod.yaml",
"request_line": "GET \/Pulumi.prod.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/Pulumi.prod.yaml",
"evidence_snippet": "GET \/Pulumi.prod.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /Pulumi.yaml
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /Pulumi.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/Pulumi.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/Pulumi.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /Pulumi.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /Pulumi.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "0aa5615705dc6bc471c2ed4ab81277ee347b4894",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.19711871184531,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "a743a0e7d92859d3fe8b5e686b841bdb1ccd64a3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "75610112eae62d56396d0c8f8e83f459",
"path_pattern_hash": "a71bd53a122199db1ad4ab94b89e63ba"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/Pulumi.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
"method": "GET",
"path": "\/Pulumi.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/Pulumi.yaml HTTP\/1.1",
"request_sample": "GET \/Pulumi.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/Pulumi.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/Pulumi.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/Pulumi.yaml HTTP\/1.1",
"request_sample": "GET \/Pulumi.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/Pulumi.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e214c98103d055f468c33811a3add23f0e73c932",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Pulumi.yaml",
"request_line": "GET \/Pulumi.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Pulumi.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/Pulumi.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/Pulumi.yaml",
"request_line": "GET \/Pulumi.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/Pulumi.yaml",
"evidence_snippet": "GET \/Pulumi.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /terragrunt.hcl
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /terragrunt.hcl UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/terragrunt.hcl
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/terragrunt.hcl
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /terragrunt.hcl HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /terragrunt.hcl HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:94
Requête brute (extrait)
GET /terragrunt.hcl HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "hcl",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "e5a52e29690bb29344d997e0ee2e7ec067a683d0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 134,
"payload_entropy": 5.093021541851131,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "12df6e4ec350ad90f660d839344ddb2856093175",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "18a027a7ecc88ad3edeb0227093dc0ac",
"path_pattern_hash": "12cf6f566d675bf5ba72966386176504"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/terragrunt.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"method": "GET",
"path": "\/terragrunt.hcl",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/terragrunt.hcl HTTP\/1.1",
"request_sample": "GET \/terragrunt.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/terragrunt.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"evidence": {
"method": "GET",
"path": "\/terragrunt.hcl",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/terragrunt.hcl HTTP\/1.1",
"request_sample": "GET \/terragrunt.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/terragrunt.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "30401e625dac6c7cb6bb2177d4cba62f5434d8ee",
"protocol_details": {
"http_method": "GET",
"http_path": "\/terragrunt.hcl",
"request_line": "GET \/terragrunt.hcl HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/terragrunt.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/terragrunt.hcl",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/terragrunt.hcl",
"request_line": "GET \/terragrunt.hcl HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/terragrunt.hcl",
"evidence_snippet": "GET \/terragrunt.hcl HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /infra/terraform.tfstate
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /infra/terraform.tfstate UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/infra/terraform.tfstate
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/infra/terraform.tfstate
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /infra/terraform.tfstate HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /infra/terraform.tfstate HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3
Requête brute (extrait)
GET /infra/terraform.tfstate HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "tfstate",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "c1ee29af0941104b39c77f354cccd537dc9f422e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 143,
"payload_entropy": 5.08056077964175,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "500072a944b54b6b007e27ec56834e4495ebb441",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "6db344ee4d245ff9c4a2a297dec8650e",
"path_pattern_hash": "2a8a0fae3e1d027732bb7c56562596ba"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/infra\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"method": "GET",
"path": "\/infra\/terraform.tfstate",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/infra\/terraform.tfstate HTTP\/1.1",
"request_sample": "GET \/infra\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/infra\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"evidence": {
"method": "GET",
"path": "\/infra\/terraform.tfstate",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/infra\/terraform.tfstate HTTP\/1.1",
"request_sample": "GET \/infra\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/infra\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4c46ff1d846826a9fe670fd7ef687cc7c6fb5e9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/infra\/terraform.tfstate",
"request_line": "GET \/infra\/terraform.tfstate HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/infra\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/infra\/terraform.tfstate",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/infra\/terraform.tfstate",
"request_line": "GET \/infra\/terraform.tfstate HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/infra\/terraform.tfstate",
"evidence_snippet": "GET \/infra\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /terraform/terraform.tfstate
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /terraform/terraform.tfstate UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_probe_terraform
Cible HTTP
GET
/terraform/terraform.tfstate
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/terraform/terraform.tfstate
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /terraform/terraform.tfstate HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /terraform/terraform.tfstate HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host:
Requête brute (extrait)
GET /terraform/terraform.tfstate HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "tfstate",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "fb4c88357eec6d2340ed0247d9e67ea3a7d9a88d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 147,
"payload_entropy": 5.06296284026015,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 37,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "b261ed8915ca1d002f1726fc92c6a2ca5ddaadef",
"event_fingerprint": "b79e3a55bc583b8c8847478ccd4198b171405284",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "acceca3030258321bdfb63a16622b595",
"path_pattern_hash": "d2ae3285e269a3a603840d76633ce76a"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/terraform\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: ",
"method": "GET",
"path": "\/terraform\/terraform.tfstate",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/terraform\/terraform.tfstate HTTP\/1.1",
"request_sample": "GET \/terraform\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/terraform\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost:",
"evidence": {
"method": "GET",
"path": "\/terraform\/terraform.tfstate",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/terraform\/terraform.tfstate HTTP\/1.1",
"request_sample": "GET \/terraform\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/terraform\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost:",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5d41ac96e7390e174e707b3db568cd3b4d205707",
"protocol_details": {
"http_method": "GET",
"http_path": "\/terraform\/terraform.tfstate",
"request_line": "GET \/terraform\/terraform.tfstate HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/terraform\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost:",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/terraform\/terraform.tfstate",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/terraform\/terraform.tfstate",
"request_line": "GET \/terraform\/terraform.tfstate HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/terraform\/terraform.tfstate",
"evidence_snippet": "GET \/terraform\/terraform.tfstate HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost:",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_probe_terraform"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /infra/terraform.tfvars
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /infra/terraform.tfvars UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/infra/terraform.tfvars
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/infra/terraform.tfvars
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /infra/terraform.tfvars HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /infra/terraform.tfvars HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.
Requête brute (extrait)
GET /infra/terraform.tfvars HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "tfvars",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "4a44058b446a20f43958d48707fa48923eb72bab",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 142,
"payload_entropy": 5.125596617282104,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "1b75fe919461c57526fd16f51eeb2b121141a706",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "4c9ba434a47f15540cbd9bc114647fa5",
"path_pattern_hash": "eacde67de060568463ee2267a6983a65"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/infra\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
"method": "GET",
"path": "\/infra\/terraform.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/infra\/terraform.tfvars HTTP\/1.1",
"request_sample": "GET \/infra\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/infra\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
"evidence": {
"method": "GET",
"path": "\/infra\/terraform.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/infra\/terraform.tfvars HTTP\/1.1",
"request_sample": "GET \/infra\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/infra\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85067104a191dc21fa20d3e6466246b568a3606a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/infra\/terraform.tfvars",
"request_line": "GET \/infra\/terraform.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/infra\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/infra\/terraform.tfvars",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/infra\/terraform.tfvars",
"request_line": "GET \/infra\/terraform.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/infra\/terraform.tfvars",
"evidence_snippet": "GET \/infra\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /terraform/terraform.tfvars
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /terraform/terraform.tfvars UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_probe_terraform
Cible HTTP
GET
/terraform/terraform.tfvars
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/terraform/terraform.tfvars
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /terraform/terraform.tfvars HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /terraform/terraform.tfvars HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 6
Requête brute (extrait)
GET /terraform/terraform.tfvars HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "tfvars",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "eac6bf62f563eb3a9985670232863928e919261f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.106705400044325,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 37,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "b261ed8915ca1d002f1726fc92c6a2ca5ddaadef",
"event_fingerprint": "d7334b7e1e1c736a90c817630b5a3ff8825244a3",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "d523940074987bc9a78097d07c6a2ade",
"path_pattern_hash": "9fa5c9147ced1655417484af25ab4642"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/terraform\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"method": "GET",
"path": "\/terraform\/terraform.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/terraform\/terraform.tfvars HTTP\/1.1",
"request_sample": "GET \/terraform\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/terraform\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"evidence": {
"method": "GET",
"path": "\/terraform\/terraform.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/terraform\/terraform.tfvars HTTP\/1.1",
"request_sample": "GET \/terraform\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/terraform\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9d10667f9e2dde137f951b4e73a5afb3c6437020",
"protocol_details": {
"http_method": "GET",
"http_path": "\/terraform\/terraform.tfvars",
"request_line": "GET \/terraform\/terraform.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/terraform\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/terraform\/terraform.tfvars",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/terraform\/terraform.tfvars",
"request_line": "GET \/terraform\/terraform.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/terraform\/terraform.tfvars",
"evidence_snippet": "GET \/terraform\/terraform.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_probe_terraform"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /production.tfvars
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /production.tfvars UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/production.tfvars
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/production.tfvars
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /production.tfvars HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /production.tfvars HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33
Requête brute (extrait)
GET /production.tfvars HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "tfvars",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "a2b638478acc0fcd54583bd34b8d0c1fe5045acc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 137,
"payload_entropy": 5.132260189151517,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "28023218ac1705ec96fc1f20c6b5e0a25253bfdf",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "6a040cd1d973daa9ce2f2071c1c24348",
"path_pattern_hash": "db22fd3a55f98671e1b02ac80cf8ddb8"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/production.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
"method": "GET",
"path": "\/production.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/production.tfvars HTTP\/1.1",
"request_sample": "GET \/production.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/production.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
"evidence": {
"method": "GET",
"path": "\/production.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/production.tfvars HTTP\/1.1",
"request_sample": "GET \/production.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/production.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b94842c37f02ba17dd88daad803bada90533ce8d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/production.tfvars",
"request_line": "GET \/production.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/production.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/production.tfvars",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/production.tfvars",
"request_line": "GET \/production.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/production.tfvars",
"evidence_snippet": "GET \/production.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /prod.tfvars
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /prod.tfvars UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/prod.tfvars
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/prod.tfvars
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /prod.tfvars HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /prod.tfvars HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "tfvars",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "07a5400aaba59c44bbcb16880c5fbfa7f095f7d5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.137948101734522,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "fdb8f2cb43dadd2775afbb54e5af16178c9d0aa9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "57b17bc6e3700bddb38cfc68dcb0d15d",
"path_pattern_hash": "c30fe9e901a3ba210c3d81ad4c023ea9"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/prod.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
"method": "GET",
"path": "\/prod.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/prod.tfvars HTTP\/1.1",
"request_sample": "GET \/prod.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/prod.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/prod.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/prod.tfvars HTTP\/1.1",
"request_sample": "GET \/prod.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/prod.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c043d3fe221cc5088867abc03e12c7b1caed06cd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/prod.tfvars",
"request_line": "GET \/prod.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/prod.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/prod.tfvars",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/prod.tfvars",
"request_line": "GET \/prod.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/prod.tfvars",
"evidence_snippet": "GET \/prod.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /secrets.tfvars
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /secrets.tfvars UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_k8s_probe
Cible HTTP
GET
/secrets.tfvars
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/secrets.tfvars
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 signal(aux) capteur
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /secrets.tfvars HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /secrets.tfvars HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:94
Requête brute (extrait)
GET /secrets.tfvars HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "tfvars",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "9fb544846a3abedf3d9f3e968112643505ae0c83",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 134,
"payload_entropy": 5.100974285685114,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fd9008172332692741e3f14f4c595f5145a3914d",
"event_fingerprint": "2e368e8c4f4b3d0499e8333e1d7d5a97f834441a",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "4f9ea573202bb3f11454d06442dc85fc",
"path_pattern_hash": "71cadcb7e8b05de789574f91079ea4cd"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/secrets.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"method": "GET",
"path": "\/secrets.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/secrets.tfvars HTTP\/1.1",
"request_sample": "GET \/secrets.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/secrets.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"evidence": {
"method": "GET",
"path": "\/secrets.tfvars",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/secrets.tfvars HTTP\/1.1",
"request_sample": "GET \/secrets.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/secrets.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae7588eb47cd72d2942809b6a284b4f7cb3a9b53",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.tfvars",
"request_line": "GET \/secrets.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/secrets.tfvars",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.tfvars",
"request_line": "GET \/secrets.tfvars HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/secrets.tfvars",
"evidence_snippet": "GET \/secrets.tfvars HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:94",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_k8s_probe"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /backend.tf
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /backend.tf UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/backend.tf
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/backend.tf
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /backend.tf HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /backend.tf HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "tf",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "736f3d84a591f80698fecf72b98102f2f51f3cd4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 130,
"payload_entropy": 5.115116398431661,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "1c37a74a993a55bae18e8b2856d7dd4e1c641fa5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "f8fec2afec5afe0fe2f09964876520a8",
"path_pattern_hash": "2af7cf01f8ff111f69ffd918399e3448"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/backend.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n",
"method": "GET",
"path": "\/backend.tf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/backend.tf HTTP\/1.1",
"request_sample": "GET \/backend.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/backend.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/backend.tf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/backend.tf HTTP\/1.1",
"request_sample": "GET \/backend.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/backend.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62fbc4d7aeef6d94103396eec5cd29d6968ea4a8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend.tf",
"request_line": "GET \/backend.tf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/backend.tf",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend.tf",
"request_line": "GET \/backend.tf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/backend.tf",
"evidence_snippet": "GET \/backend.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /k8s/deployment.yaml
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /k8s/deployment.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/k8s/deployment.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/k8s/deployment.yaml
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /k8s/deployment.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /k8s/deployment.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.
Requête brute (extrait)
GET /k8s/deployment.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "7493ccbb1fce1ebfd24563f1db3eee1615874d9f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 139,
"payload_entropy": 5.2045792225601755,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "08d2fc5383afefaa5cdf21238fd8115021c0ef3f",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "ff37e2abf845dafc76f7f8b5ce32ed2a",
"path_pattern_hash": "24aa14ea1b95a59c22024cc831bf78da"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/k8s\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"method": "GET",
"path": "\/k8s\/deployment.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/k8s\/deployment.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/k8s\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"evidence": {
"method": "GET",
"path": "\/k8s\/deployment.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/k8s\/deployment.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/k8s\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df011e6f3a2899f6b5936c90f77fee664fd2ae4a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/deployment.yaml",
"request_line": "GET \/k8s\/deployment.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/k8s\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/deployment.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/deployment.yaml",
"request_line": "GET \/k8s\/deployment.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/deployment.yaml",
"evidence_snippet": "GET \/k8s\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /provider.tf
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /provider.tf UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/provider.tf
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/provider.tf
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /provider.tf HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /provider.tf HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "tf",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "b1d038205b1f2deea6de1f109979d49de2b5c0d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.125959243283155,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "872894ea9b66125360bd06b1606ee6410261c0d3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "b35ffb09002b15e51e4c285d94086aaa",
"path_pattern_hash": "c9cc320b59dda60b7d388c132c4fd4bd"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/provider.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
"method": "GET",
"path": "\/provider.tf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/provider.tf HTTP\/1.1",
"request_sample": "GET \/provider.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/provider.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/provider.tf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/provider.tf HTTP\/1.1",
"request_sample": "GET \/provider.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/provider.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85803bd2e1a8d54d84fbaf9a95233e3372fe444f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/provider.tf",
"request_line": "GET \/provider.tf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/provider.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/provider.tf",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/provider.tf",
"request_line": "GET \/provider.tf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/provider.tf",
"evidence_snippet": "GET \/provider.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /outputs.tf
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /outputs.tf UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/outputs.tf
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/outputs.tf
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /outputs.tf HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /outputs.tf HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "tf",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "f11cdcbc349f4887e9a41b77a7d7b055792d55aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 130,
"payload_entropy": 5.102556951810576,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "43ac2111d625ef1e66f6740819c8fc92b22c5d5e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "e1ea2fbdf90ca61724a0d12d28659ba2",
"path_pattern_hash": "b30fe5982eb49eba7adbfa23ff42fa2b"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/outputs.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n",
"method": "GET",
"path": "\/outputs.tf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/outputs.tf HTTP\/1.1",
"request_sample": "GET \/outputs.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/outputs.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/outputs.tf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/outputs.tf HTTP\/1.1",
"request_sample": "GET \/outputs.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/outputs.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d7aba76fd31c8cf9d8acdffec808d5549df093dc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/outputs.tf",
"request_line": "GET \/outputs.tf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/outputs.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/outputs.tf",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/outputs.tf",
"request_line": "GET \/outputs.tf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/outputs.tf",
"evidence_snippet": "GET \/outputs.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /k8s/configmap.yaml
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /k8s/configmap.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/k8s/configmap.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/k8s/configmap.yaml
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /k8s/configmap.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /k8s/configmap.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.3
Requête brute (extrait)
GET /k8s/configmap.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "8bfa455ae7f47cfdd21392662c4d66eee57518f9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 138,
"payload_entropy": 5.215691964156979,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "57aa2235b3d2e800670c61d47dcb62998b1dbedb",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "a51b2f2ecf0ed543f649a501a2aca322",
"path_pattern_hash": "eb353eab7b58cc3540dfb65ab23608ac"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/k8s\/configmap.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"method": "GET",
"path": "\/k8s\/configmap.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/k8s\/configmap.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/configmap.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/k8s\/configmap.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"evidence": {
"method": "GET",
"path": "\/k8s\/configmap.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/k8s\/configmap.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/configmap.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/k8s\/configmap.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "05b01ac4317de10700924e1dc95a5af173a96bcf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/configmap.yaml",
"request_line": "GET \/k8s\/configmap.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/k8s\/configmap.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/configmap.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/configmap.yaml",
"request_line": "GET \/k8s\/configmap.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/configmap.yaml",
"evidence_snippet": "GET \/k8s\/configmap.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /main.tf
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /main.tf UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/main.tf
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/main.tf
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /main.tf HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /main.tf HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "tf",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "99a08d986856b2b5cc378ff420b6e3b0f3918740",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 127,
"payload_entropy": 5.12185058499807,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "1541f8e876b8ebd9e946b2d51d7dd23a9eb097e7",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "57a99b02f85d40f693f0fdffbbc18087",
"path_pattern_hash": "9cd540a25ee3aead992d0fcc54498abf"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/main.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"method": "GET",
"path": "\/main.tf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/main.tf HTTP\/1.1",
"request_sample": "GET \/main.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/main.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/main.tf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/main.tf HTTP\/1.1",
"request_sample": "GET \/main.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/main.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f42a9c9726a1da86712d4599a9302981d1012682",
"protocol_details": {
"http_method": "GET",
"http_path": "\/main.tf",
"request_line": "GET \/main.tf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/main.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/main.tf",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/main.tf",
"request_line": "GET \/main.tf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/main.tf",
"evidence_snippet": "GET \/main.tf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /helm/values.yaml
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /helm/values.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_helm_probe
Cible HTTP
GET
/helm/values.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/helm/values.yaml
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /helm/values.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /helm/values.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:
Requête brute (extrait)
GET /helm/values.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "4b8c3a91cc09ea22fce0bbb577426e64fe04c86c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 136,
"payload_entropy": 5.187867640895996,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 37,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ed98953275dff67289bcef16f38419ecdb53b9d2",
"event_fingerprint": "efca155c1b84df14663159aea8c98d10ee420226",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "eb08f3abbf65c05d68872c00a7c0ca2d",
"path_pattern_hash": "ceffd3c347f61c55757e37ab82366886"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/helm\/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"method": "GET",
"path": "\/helm\/values.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/helm\/values.yaml HTTP\/1.1",
"request_sample": "GET \/helm\/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/helm\/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"evidence": {
"method": "GET",
"path": "\/helm\/values.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/helm\/values.yaml HTTP\/1.1",
"request_sample": "GET \/helm\/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/helm\/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "147f0e6a3ec2bed4d0603c198ca14bb54c1f726f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/helm\/values.yaml",
"request_line": "GET \/helm\/values.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/helm\/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/helm\/values.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/helm\/values.yaml",
"request_line": "GET \/helm\/values.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/helm\/values.yaml",
"evidence_snippet": "GET \/helm\/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_helm_probe"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /k8s/secrets.yaml
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /k8s/secrets.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_k8s_probe
Cible HTTP
GET
/k8s/secrets.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/k8s/secrets.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /k8s/secrets.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /k8s/secrets.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:
Requête brute (extrait)
GET /k8s/secrets.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "2b1f9fcb0e458e03ecb59a778e784573bcf025ce",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 136,
"payload_entropy": 5.180540711319897,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 37,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5f61dd631f03aef151ccadfba9f26441de08d9cb",
"event_fingerprint": "dc2a2940a7353d0be2c3f499e1136e43c4cd2851",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "fd60d5630a9010d23ab24809e2f68ac8",
"path_pattern_hash": "3e2cca0fd234715d366a6869e4aaf6ff"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"method": "GET",
"path": "\/k8s\/secrets.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/k8s\/secrets.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"evidence": {
"method": "GET",
"path": "\/k8s\/secrets.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/k8s\/secrets.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e6f39804cc9733ab6d74923fb9857e0a2f69300",
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/secrets.yaml",
"request_line": "GET \/k8s\/secrets.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/secrets.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/secrets.yaml",
"request_line": "GET \/k8s\/secrets.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/secrets.yaml",
"evidence_snippet": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_k8s_probe"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /values.yaml
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /values.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/values.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/values.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /values.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /values.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "70533a23b560e26f9e6cc7332711f5c1ddc0b74f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.186851704456406,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "eae134be6936808d9d2e7fb77c146ff6f29f0dca",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "b94407d85b70dedd53088541504e7c58",
"path_pattern_hash": "b75dca7d3615dbb908462c2e7a0eb349"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
"method": "GET",
"path": "\/values.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/values.yaml HTTP\/1.1",
"request_sample": "GET \/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/values.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/values.yaml HTTP\/1.1",
"request_sample": "GET \/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "76ea8807c78ab0d85c742313d8930b32f0f66154",
"protocol_details": {
"http_method": "GET",
"http_path": "\/values.yaml",
"request_line": "GET \/values.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/values.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/values.yaml",
"request_line": "GET \/values.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/values.yaml",
"evidence_snippet": "GET \/values.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /k8s/secret.yaml
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /k8s/secret.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/k8s/secret.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/k8s/secret.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /k8s/secret.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /k8s/secret.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9
Requête brute (extrait)
GET /k8s/secret.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "d792b8c7908ee2abaf9bc77eee9ca8b6511c0b2a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 135,
"payload_entropy": 5.182506195598218,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "c6ca70932b0a1e82f0d7dacd6f35dc6a616b5384",
"event_fingerprint": "f59b3ba40fd4c3826d8887b3866134873cdf43cc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "e3149e00adb5439ad212045fffa605cf",
"path_pattern_hash": "0981fdb077c0bf66b225a0dc89da1483"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/k8s\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"method": "GET",
"path": "\/k8s\/secret.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/k8s\/secret.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/k8s\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"evidence": {
"method": "GET",
"path": "\/k8s\/secret.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/k8s\/secret.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/k8s\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c94a6cdc508d9a9e4484aa08bcec32d721935d2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/secret.yaml",
"request_line": "GET \/k8s\/secret.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/k8s\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/secret.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/secret.yaml",
"request_line": "GET \/k8s\/secret.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/k8s\/secret.yaml",
"evidence_snippet": "GET \/k8s\/secret.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /kubernetes/deployment.yaml
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /kubernetes/deployment.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/kubernetes/deployment.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/kubernetes/deployment.yaml
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
Probe /kubernetes/
Ligne de requête
GET /kubernetes/deployment.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /kubernetes/deployment.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 6
Requête brute (extrait)
GET /kubernetes/deployment.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "206f87ea3b666643d69501cdfa1b4c2d3dc8a7f4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.153211419999884,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "023ef5dd34b33302bc1bd4e2db0b1e1046807cda",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"matched_patterns": [
"pat-0216"
],
"matched_pattern_names": [
"Probe \/kubernetes\/"
],
"pattern_ids": [
"pat-0216"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "a42348d67921f812e291602c486cdca8",
"path_pattern_hash": "4a90f2ced5ad4ba1f1f687169d3dbd64"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/kubernetes\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"method": "GET",
"path": "\/kubernetes\/deployment.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/kubernetes\/deployment.yaml HTTP\/1.1",
"request_sample": "GET \/kubernetes\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/kubernetes\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"evidence": {
"method": "GET",
"path": "\/kubernetes\/deployment.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/kubernetes\/deployment.yaml HTTP\/1.1",
"request_sample": "GET \/kubernetes\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/kubernetes\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "602c6c955049da1de9692285e198c497eda0bb8a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/kubernetes\/deployment.yaml",
"request_line": "GET \/kubernetes\/deployment.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/kubernetes\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/deployment.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/kubernetes\/deployment.yaml",
"request_line": "GET \/kubernetes\/deployment.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/deployment.yaml",
"evidence_snippet": "GET \/kubernetes\/deployment.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /kubernetes/secrets.yaml
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /kubernetes/secrets.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_k8s_probe
Cible HTTP
GET
/kubernetes/secrets.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/kubernetes/secrets.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
Probe /kubernetes/
Ligne de requête
GET /kubernetes/secrets.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /kubernetes/secrets.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3
Requête brute (extrait)
GET /kubernetes/secrets.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "46fcf21a143d6ce7b03143ec5ce4c3d1b460a985",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 143,
"payload_entropy": 5.126030211954454,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 37,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5f61dd631f03aef151ccadfba9f26441de08d9cb",
"event_fingerprint": "d8bf32111a58276cba5230d6a6411972eccbe128",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"matched_patterns": [
"pat-0216"
],
"matched_pattern_names": [
"Probe \/kubernetes\/"
],
"pattern_ids": [
"pat-0216"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "ec51126039ca4e4ecf21d2b80983a4a4",
"path_pattern_hash": "db0a7ad2d9d66d2db43b839a246a12ad"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"method": "GET",
"path": "\/kubernetes\/secrets.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/kubernetes\/secrets.yaml HTTP\/1.1",
"request_sample": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"evidence": {
"method": "GET",
"path": "\/kubernetes\/secrets.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/kubernetes\/secrets.yaml HTTP\/1.1",
"request_sample": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b237ac03dcee20577e998a317e5b011f7be84c2c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/kubernetes\/secrets.yaml",
"request_line": "GET \/kubernetes\/secrets.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/secrets.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/kubernetes\/secrets.yaml",
"request_line": "GET \/kubernetes\/secrets.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/secrets.yaml",
"evidence_snippet": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_k8s_probe"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /Dockerrun.aws.json
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /Dockerrun.aws.json UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/Dockerrun.aws.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/Dockerrun.aws.json
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /Dockerrun.aws.json HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /Dockerrun.aws.json HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.3
Requête brute (extrait)
GET /Dockerrun.aws.json HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "264337914cc03680fb0963a167c0c236d957cbc7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 138,
"payload_entropy": 5.185123215360733,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "bb14b34d2ac2cd72d11ae8214147bf1fb7ff44af",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "0f2e331e7354b9cdfec4613aef40a3d9",
"path_pattern_hash": "b492f2ad5d84342e66dfdae0ce75225a"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/Dockerrun.aws.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"method": "GET",
"path": "\/Dockerrun.aws.json",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/Dockerrun.aws.json HTTP\/1.1",
"request_sample": "GET \/Dockerrun.aws.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/Dockerrun.aws.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"evidence": {
"method": "GET",
"path": "\/Dockerrun.aws.json",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/Dockerrun.aws.json HTTP\/1.1",
"request_sample": "GET \/Dockerrun.aws.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/Dockerrun.aws.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ca543be35c0db1cfbbfe430499942b7ca3b94a0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Dockerrun.aws.json",
"request_line": "GET \/Dockerrun.aws.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Dockerrun.aws.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/Dockerrun.aws.json",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/Dockerrun.aws.json",
"request_line": "GET \/Dockerrun.aws.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/Dockerrun.aws.json",
"evidence_snippet": "GET \/Dockerrun.aws.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /amplify.yml
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /amplify.yml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/amplify.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/amplify.yml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /amplify.yml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /amplify.yml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "6546f3979aa1e587d8cb96658237193d086a1cad",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.1905938799958955,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "51eacebfcd349a952e9d976b6f271889ed67b069",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "1f383c3bb51cba8c3c6ddb8eeba6532b",
"path_pattern_hash": "42d8cf625c787eb1dc022fefc04f5912"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/amplify.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
"method": "GET",
"path": "\/amplify.yml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/amplify.yml HTTP\/1.1",
"request_sample": "GET \/amplify.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/amplify.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/amplify.yml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/amplify.yml HTTP\/1.1",
"request_sample": "GET \/amplify.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/amplify.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36c060c58f34d7053b1fc7469080c43720ce9ebd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/amplify.yml",
"request_line": "GET \/amplify.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/amplify.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/amplify.yml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/amplify.yml",
"request_line": "GET \/amplify.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/amplify.yml",
"evidence_snippet": "GET \/amplify.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:9400 · (sonde / probe) · → /buildspec.yml
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /buildspec.yml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/buildspec.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/buildspec.yml
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 5
Confiance : Confiance 55 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /buildspec.yml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /buildspec.yml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:940
Requête brute (extrait)
GET /buildspec.yml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "17305b41a7df76f3dde94b9585530b5e8df77ea0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 133,
"payload_entropy": 5.170652906029159,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "ac3e91d5047f254ffc0e82b238e9ebe0c2d50768",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "a002fa823c7b926ae026921d1a752e85",
"path_pattern_hash": "ba0c1a05c5ce257db38abfe6528a2269"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 5
},
"payload_preview": "GET \/buildspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"method": "GET",
"path": "\/buildspec.yml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/buildspec.yml HTTP\/1.1",
"request_sample": "GET \/buildspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/buildspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"evidence": {
"method": "GET",
"path": "\/buildspec.yml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/buildspec.yml HTTP\/1.1",
"request_sample": "GET \/buildspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/buildspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.55,
"classification_confidence": 0.55,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d1bca5063d51ca5275d55f768df09cf178538998",
"protocol_details": {
"http_method": "GET",
"http_path": "\/buildspec.yml",
"request_line": "GET \/buildspec.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/buildspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/buildspec.yml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 5,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/buildspec.yml",
"request_line": "GET \/buildspec.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/buildspec.yml",
"evidence_snippet": "GET \/buildspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:940",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:9400 · (tentative d'exploit) · → /.elasticbeanstalk/config.yml
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /.elasticbeanstalk/config.yml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/.elasticbeanstalk/config.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.elasticbeanstalk/config.yml
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.elasticbeanstalk/config.yml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /.elasticbeanstalk/config.yml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host:
Requête brute (extrait)
GET /.elasticbeanstalk/config.yml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "c8b21aa9bea67139c44bc532fe81cb0432de38bd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 148,
"payload_entropy": 5.1432887063740065,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 46,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "92660a069d0cd7a159abb599b87043becff00ed5",
"event_fingerprint": "c21f01f136a2d9d387da8322806f6931b76ecafb",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "a7c797d38871b9e875635066c42d4a22",
"path_pattern_hash": "e09d85c9b77fbabaeba82d0ae6bfd189"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost:",
"method": "GET",
"path": "\/.elasticbeanstalk\/config.yml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1",
"request_sample": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost:",
"evidence": {
"method": "GET",
"path": "\/.elasticbeanstalk\/config.yml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1",
"request_sample": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92cc370942203b10f304a8321d76171658b506f0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.elasticbeanstalk\/config.yml",
"request_line": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost:",
"attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.elasticbeanstalk\/config.yml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.elasticbeanstalk\/config.yml",
"request_line": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.elasticbeanstalk\/config.yml",
"evidence_snippet": "GET \/.elasticbeanstalk\/config.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost:",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan secrets (CI/CD / clés)
secret scan · via HTTP:9400 · (tentative d'exploit) · → /azure-pipelines.yml
|
Élevée
|
Faible · 35
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /azure-pipelines.yml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/azure-pipelines.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/azure-pipelines.yml
Pourquoi cette classification : Sonde fichier sensible: secret CI/CD · Correspondance tags WAF · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 35
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /azure-pipelines.yml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /azure-pipelines.yml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.
Requête brute (extrait)
GET /azure-pipelines.yml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "8bacf7ba189e1d49695131e01ec30c1752198ab0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 139,
"payload_entropy": 5.147245842838636,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 35,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "a3ad7173873a82c1d387abccc0d8bf00802c79f3",
"event_fingerprint": "e12dcceb7b68ef52954c2b3946f830ae90edc2f2",
"classification_reason": "Sonde fichier sensible: secret CI\/CD \u00b7 Correspondance tags WAF \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "df94fc4ceab46aef6cde22710c871b3c",
"path_pattern_hash": "d76578f2ff8c409283f48927713c6e3e"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/azure-pipelines.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"method": "GET",
"path": "\/azure-pipelines.yml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/azure-pipelines.yml HTTP\/1.1",
"request_sample": "GET \/azure-pipelines.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/azure-pipelines.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"evidence": {
"method": "GET",
"path": "\/azure-pipelines.yml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/azure-pipelines.yml HTTP\/1.1",
"request_sample": "GET \/azure-pipelines.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/azure-pipelines.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"classification_reason": "Sonde fichier sensible: secret CI\/CD \u00b7 Correspondance tags WAF \u00b7 confiance 0%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9b48a55e33a5ecb6764a6a97b166667a15a3d8f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/azure-pipelines.yml",
"request_line": "GET \/azure-pipelines.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/azure-pipelines.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"attack_vector": "secret scan \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/azure-pipelines.yml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: secret CI\/CD \u00b7 Correspondance tags WAF \u00b7 confiance 0%",
"classification_reason_label_fr": "Sonde fichier sensible: secret CI\/CD \u00b7 Correspondance tags WAF \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0001 \u2014 via HTTP",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/azure-pipelines.yml",
"request_line": "GET \/azure-pipelines.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "secret scan \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/azure-pipelines.yml",
"evidence_snippet": "GET \/azure-pipelines.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:9400 · (sonde / probe) · → /appspec.yml
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /appspec.yml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/appspec.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/appspec.yml
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 5
Confiance : Confiance 55 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /appspec.yml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /appspec.yml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "d2428aafd8883a4a376312df31924ec1f0ada104",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.134205926195034,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "a5424fc42574661e4c32893f52ccb90fd2505c6e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "8cd70f509b4edcf3acc2d13bb469ca48",
"path_pattern_hash": "84d8555e5a6c5d25861e9dea39f39d1c"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 5
},
"payload_preview": "GET \/appspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r",
"method": "GET",
"path": "\/appspec.yml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/appspec.yml HTTP\/1.1",
"request_sample": "GET \/appspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/appspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/appspec.yml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/appspec.yml HTTP\/1.1",
"request_sample": "GET \/appspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/appspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.55,
"classification_confidence": 0.55,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "224f1804f5afbe38a1d1464af3616fe0a8cb20cf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/appspec.yml",
"request_line": "GET \/appspec.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/appspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/appspec.yml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 5,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/appspec.yml",
"request_line": "GET \/appspec.yml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/appspec.yml",
"evidence_snippet": "GET \/appspec.yml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
http · via HTTP:9400 · (sonde / probe) · → /cloudbuild.yaml
|
Faible
|
Faible · 5
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /cloudbuild.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/cloudbuild.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/cloudbuild.yaml
Pourquoi cette classification : Type « http » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 5
Confiance : Confiance 55 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /cloudbuild.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /cloudbuild.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9
Requête brute (extrait)
GET /cloudbuild.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "a0377c51ab59d94a0faa51299c3013c9fd4d4ac4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 135,
"payload_entropy": 5.182733308329375,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 5,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "a495f295a88b9febef65527709f474204a441b2d",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "4c6ae056a9c8b90b221e98bd8596fdad",
"path_pattern_hash": "30f89358247341b80917430415da228b"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 5
},
"payload_preview": "GET \/cloudbuild.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"method": "GET",
"path": "\/cloudbuild.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/cloudbuild.yaml HTTP\/1.1",
"request_sample": "GET \/cloudbuild.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/cloudbuild.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"evidence": {
"method": "GET",
"path": "\/cloudbuild.yaml",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/cloudbuild.yaml HTTP\/1.1",
"request_sample": "GET \/cloudbuild.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/cloudbuild.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"confidence": 0.55,
"classification_confidence": 0.55,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0482550cee29f56830af94a10ecb121d576220a4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cloudbuild.yaml",
"request_line": "GET \/cloudbuild.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cloudbuild.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cloudbuild.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 5
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 5,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cloudbuild.yaml",
"request_line": "GET \/cloudbuild.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/cloudbuild.yaml",
"evidence_snippet": "GET \/cloudbuild.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:9400 · (tentative d'exploit) · → /.paperspace/config.json
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.paperspace/config.json UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_sensitive_path
Cible HTTP
GET
/.paperspace/config.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.paperspace/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.paperspace/config.json HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /.paperspace/config.json HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3
Requête brute (extrait)
GET /.paperspace/config.json HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "530b5e2344d66812f21632033730011aa80cecd4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 143,
"payload_entropy": 5.084263507558912,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "4089670e91dbafa27baac3dd1b5ce1f5a9665714",
"event_fingerprint": "5e06f6b47436112eddfe21c0f5ee51707bcb0bda",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "9381abce481864f2e7588bc9715f3324",
"path_pattern_hash": "87a381e386745b574338f9bc4a66dbcb"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/.paperspace\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"method": "GET",
"path": "\/.paperspace\/config.json",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.paperspace\/config.json HTTP\/1.1",
"request_sample": "GET \/.paperspace\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.paperspace\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"evidence": {
"method": "GET",
"path": "\/.paperspace\/config.json",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.paperspace\/config.json HTTP\/1.1",
"request_sample": "GET \/.paperspace\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.paperspace\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c9c6b29f6721809f8d90d26629763441398951a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.paperspace\/config.json",
"request_line": "GET \/.paperspace\/config.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.paperspace\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.paperspace\/config.json",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.paperspace\/config.json",
"request_line": "GET \/.paperspace\/config.json HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:9400 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.paperspace\/config.json",
"evidence_snippet": "GET \/.paperspace\/config.json HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_sensitive_path"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:9400 · (sonde / probe) · → /.lambda_cloud/lambda_keys
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /.lambda_cloud/lambda_keys UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/.lambda_cloud/lambda_keys
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.lambda_cloud/lambda_keys
Pourquoi cette classification : Sonde HTTP (tag nosqli-3) · confiance 68%
Confiance classification
68%
Risque capteur
Moyen
· 40
Confiance : Confiance 68 % — Score WAF 32 · 1 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /.lambda_cloud/lambda_keys HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /.lambda_cloud/lambda_keys HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62
Requête brute (extrait)
GET /.lambda_cloud/lambda_keys HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "lambda_cloud\/lambda_keys",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "db522ec0d094416a11f3db2c2aa88047d7b2d0f3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 145,
"payload_entropy": 5.221283535616821,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "bdb6255d8efcf5db42a67995e69149310ba8d352",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "ff0cd2ef72ea540ceafa13fb9bdbf575",
"path_pattern_hash": "6ec508c7c9de3174639136513d55dc99"
},
"service_name": "http",
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62",
"method": "GET",
"path": "\/.lambda_cloud\/lambda_keys",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1",
"request_sample": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62",
"evidence": {
"method": "GET",
"path": "\/.lambda_cloud\/lambda_keys",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1",
"request_sample": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62",
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%"
},
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%",
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.68,
"classification_confidence": 0.68,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3f413924cae708e199ea657b8500e89e4efc833",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.lambda_cloud\/lambda_keys",
"request_line": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.lambda_cloud\/lambda_keys",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%",
"classification_reason_label_fr": "Sonde HTTP (tag nosqli-3) \u00b7 confiance 68%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.lambda_cloud\/lambda_keys",
"request_line": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:9400 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/.lambda_cloud\/lambda_keys",
"evidence_snippet": "GET \/.lambda_cloud\/lambda_keys HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /.ovh.conf
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /.ovh.conf UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/.ovh.conf
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.ovh.conf
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /.ovh.conf HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /.ovh.conf HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "conf",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "8f4fd571b1c8f942f71922e843fe07eab412b6c8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 129,
"payload_entropy": 5.121746999939813,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "c6374e67aef5b7bee621b4a3a0ae12c2de181e1d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "8adfea7b02b7d79c65ab4f64b4973e97",
"path_pattern_hash": "b50646150f53619c3eee5a0be12543d9"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/.ovh.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r",
"method": "GET",
"path": "\/.ovh.conf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/.ovh.conf HTTP\/1.1",
"request_sample": "GET \/.ovh.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.ovh.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/.ovh.conf",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/.ovh.conf HTTP\/1.1",
"request_sample": "GET \/.ovh.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.ovh.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4349fb76ebc119df890cff55e578aa8ee8859f71",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.ovh.conf",
"request_line": "GET \/.ovh.conf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.ovh.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.ovh.conf",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.ovh.conf",
"request_line": "GET \/.ovh.conf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.ovh.conf",
"evidence_snippet": "GET \/.ovh.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /.config/linode-cli
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /.config/linode-cli UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/.config/linode-cli
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.config/linode-cli
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /.config/linode-cli HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /.config/linode-cli HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.3
Requête brute (extrait)
GET /.config/linode-cli HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "config\/linode-cli",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "badc01b3bbe0a6180797300c6ddffcbdf67d45f6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 138,
"payload_entropy": 5.092696494330563,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "405d4dbe6b65ed96ea8dce0a478692657faf7a4e",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "f5b3dc6140a76f269686943fb6ca0fc4",
"path_pattern_hash": "f8540d0eb6ad270187b93eacb1ed8cd9"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/.config\/linode-cli HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"method": "GET",
"path": "\/.config\/linode-cli",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.config\/linode-cli HTTP\/1.1",
"request_sample": "GET \/.config\/linode-cli HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.config\/linode-cli HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"evidence": {
"method": "GET",
"path": "\/.config\/linode-cli",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.config\/linode-cli HTTP\/1.1",
"request_sample": "GET \/.config\/linode-cli HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.config\/linode-cli HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5592d85fabf7594d0ebb412bc813e4ec0b9bffc9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.config\/linode-cli",
"request_line": "GET \/.config\/linode-cli HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.config\/linode-cli HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/linode-cli",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.config\/linode-cli",
"request_line": "GET \/.config\/linode-cli HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/linode-cli",
"evidence_snippet": "GET \/.config\/linode-cli HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.3",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /.config/scw/config.yaml
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /.config/scw/config.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/.config/scw/config.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.config/scw/config.yaml
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /.config/scw/config.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /.config/scw/config.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3
Requête brute (extrait)
GET /.config/scw/config.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "813362c9ae92bbfec072a3c466f3cf32c86ef445",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 143,
"payload_entropy": 5.160160173641421,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "92660a069d0cd7a159abb599b87043becff00ed5",
"event_fingerprint": "f26eb257321ad889ba5a8e9143ef6a8113f7ccb3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "f31a7d2c9c46acbf70c081bfdcdcada1",
"path_pattern_hash": "c3e8f174b6ce4d5abc373b4dac20dc71"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/.config\/scw\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"method": "GET",
"path": "\/.config\/scw\/config.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.config\/scw\/config.yaml HTTP\/1.1",
"request_sample": "GET \/.config\/scw\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.config\/scw\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"evidence": {
"method": "GET",
"path": "\/.config\/scw\/config.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.config\/scw\/config.yaml HTTP\/1.1",
"request_sample": "GET \/.config\/scw\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.config\/scw\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a9d15876855405351b7a426d898d2327f9d175d5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.config\/scw\/config.yaml",
"request_line": "GET \/.config\/scw\/config.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.config\/scw\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/scw\/config.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.config\/scw\/config.yaml",
"request_line": "GET \/.config\/scw\/config.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/scw\/config.yaml",
"evidence_snippet": "GET \/.config\/scw\/config.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /.config/rclone/rclone.conf
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /.config/rclone/rclone.conf UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/.config/rclone/rclone.conf
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.config/rclone/rclone.conf
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /.config/rclone/rclone.conf HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /.config/rclone/rclone.conf HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 6
Requête brute (extrait)
GET /.config/rclone/rclone.conf HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "conf",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "0e7f384f7082a187a12f246c91fad61ec08e46bb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 146,
"payload_entropy": 5.05213135854556,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "35f59003ca8d480da55273f6c9879aabd698a51e",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "1cc880b5a8cd6eb1b7db105fa46dffcf",
"path_pattern_hash": "2cca34bf2328616dc823f3fe842817e6"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"method": "GET",
"path": "\/.config\/rclone\/rclone.conf",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1",
"request_sample": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"evidence": {
"method": "GET",
"path": "\/.config\/rclone\/rclone.conf",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1",
"request_sample": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "52480ee829eadc4af3c245a11171bc459e84567d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.config\/rclone\/rclone.conf",
"request_line": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/rclone\/rclone.conf",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.config\/rclone\/rclone.conf",
"request_line": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/rclone\/rclone.conf",
"evidence_snippet": "GET \/.config\/rclone\/rclone.conf HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 6",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /.boto
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /.boto UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/.boto
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.boto
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /.boto HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /.boto HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "boto",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "214a1a6b0149a034bc1649d952888474e38f467c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 5.094242813481424,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "f63a98a7ba838c675091ca5fdc01bded28798a90",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "c27afdcd006759e9992bca3fa4b834a1",
"path_pattern_hash": "0fb4b25cccb2d230de143c7bdf21ee3f"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/.boto HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"method": "GET",
"path": "\/.boto",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/.boto HTTP\/1.1",
"request_sample": "GET \/.boto HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.boto HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/.boto",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/.boto HTTP\/1.1",
"request_sample": "GET \/.boto HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.boto HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f04dce42d7cea36485cfa62922ae9c8961fa70e5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.boto",
"request_line": "GET \/.boto HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.boto HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.boto",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.boto",
"request_line": "GET \/.boto HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.boto",
"evidence_snippet": "GET \/.boto HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /.s3ql/authinfo2
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /.s3ql/authinfo2 UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/.s3ql/authinfo2
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.s3ql/authinfo2
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /.s3ql/authinfo2 HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /.s3ql/authinfo2 HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9
Requête brute (extrait)
GET /.s3ql/authinfo2 HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "s3ql\/authinfo2",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "efc7a287463296728a576f2418aef9b89dae0ad1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 135,
"payload_entropy": 5.160537290386043,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "0693cf17990d80c3bcc7827340e175d584abdfdf",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "ab80fd430bfaedd2d521b3de2fa14397",
"path_pattern_hash": "8a9d84b07e2a231d0303cd8869a484b9"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/.s3ql\/authinfo2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"method": "GET",
"path": "\/.s3ql\/authinfo2",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.s3ql\/authinfo2 HTTP\/1.1",
"request_sample": "GET \/.s3ql\/authinfo2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.s3ql\/authinfo2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"evidence": {
"method": "GET",
"path": "\/.s3ql\/authinfo2",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.s3ql\/authinfo2 HTTP\/1.1",
"request_sample": "GET \/.s3ql\/authinfo2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.s3ql\/authinfo2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a4d81b258d523d167b4f3388628789ebfebd127",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.s3ql\/authinfo2",
"request_line": "GET \/.s3ql\/authinfo2 HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.s3ql\/authinfo2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.s3ql\/authinfo2",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.s3ql\/authinfo2",
"request_line": "GET \/.s3ql\/authinfo2 HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.s3ql\/authinfo2",
"evidence_snippet": "GET \/.s3ql\/authinfo2 HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /.config/openstack/secure.yaml
|
Élevée
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /.config/openstack/secure.yaml UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
Cible HTTP
GET
/.config/openstack/secure.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.config/openstack/secure.yaml
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance 52 % — 1 tag(s) WAF
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /.config/openstack/secure.yaml HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
nosqli-3
Payload (extrait)
GET /.config/openstack/secure.yaml HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host
Requête brute (extrait)
GET /.config/openstack/secure.yaml HTTP/1.1 accept: */* user-agent: WebSiphon/next-0.1 accept-encoding: gzip,deflate,br host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "yaml",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "945c5d5c60bc06f28fb307c26f8cb79786491300",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 149,
"payload_entropy": 5.137784377323733,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 32,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "22dc70396a20ed51a85140f9eba4fb4c93407aaf",
"event_fingerprint": "d6971c59a93fd6580bdca408739dd940c8adf90a",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "d6b403940a859ce0378288ac4c000cb0",
"path_pattern_hash": "e9c5be64ea6dcf05a93271bde75daf58"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
"method": "GET",
"path": "\/.config\/openstack\/secure.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1",
"request_sample": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
"evidence": {
"method": "GET",
"path": "\/.config\/openstack\/secure.yaml",
"user_agent": "WebSiphon\/next-0.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1",
"request_sample": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "803dce07323db36107f99f14fb7b92426971cb38",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.config\/openstack\/secure.yaml",
"request_line": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/openstack\/secure.yaml",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 32,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.config\/openstack\/secure.yaml",
"request_line": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.config\/openstack\/secure.yaml",
"evidence_snippet": "GET \/.config\/openstack\/secure.yaml HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 52 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3"
]
}
|
|
|
TCP |
9400 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:9400 · (reconnaissance) · → /.s3cfg
|
Faible
|
Faible · 37
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /.s3cfg UA WebSiphon/next-0.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
—
Cible HTTP
GET
/.s3cfg
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9400
Chemin / cible
/.s3cfg
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52%
Confiance classification
52%
Risque capteur
Faible
· 37
Confiance : Confiance modérée (52 %) — signal principal unique
Signaux
Beh Scan Burst
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Ligne de requête
GET /.s3cfg HTTP/1.1
User-Agent
WebSiphon/next-0.1
Règles WAF
—
Payload (extrait)
GET /.s3cfg HTTP/1.1
accept: */*
user-agent: WebSiphon/next-0.1
accept-encoding: gzip,deflate,br
host: 62.3.50.33:9400
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "s3cfg",
"http_ua_hash": "72cd8c2bff9aefc99b70d8e7774b74c0c85e1524",
"http_host_hash": "93cbddeebb40368661e52794ed235fef470a2303",
"http_target_hash": "4c25da7cd611bca891760bac65d70c1a318a478d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 5.10952928063645,
"port_category": "registered",
"org": "Oracle Corporation",
"service": "http",
"app_proto": "http",
"asn": 31898,
"country": "SG",
"dst_port": 9400,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 37,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3c29b65fd3f191e1e13aae65d592160b8298a71f",
"event_fingerprint": "7eca413dce0a027a80ce8b26f8a3af672b7a5095",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"confidence": 0.52,
"classification_confidence": 0.52,
"precision_score": 62,
"precision_signals": [
"INT-beh-scan-burst"
],
"kb_rule_ids": [
"INT-beh-scan-burst"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 52,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SG",
"asn": 31898,
"org": "Oracle Corporation",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ae917b654ef4f95bac2c2f7f69dc5141",
"payload_hash": "e37ee276aafb5cc959dd8d0ba6a56826",
"path_pattern_hash": "9ef30b9a054a1c1570d772da184864d9"
},
"target_context": {
"dst_port": 9400,
"service": "http",
"service_name": "http",
"risk_score": 37
},
"payload_preview": "GET \/.s3cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"method": "GET",
"path": "\/.s3cfg",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/.s3cfg HTTP\/1.1",
"request_sample": "GET \/.s3cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.s3cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"evidence": {
"method": "GET",
"path": "\/.s3cfg",
"user_agent": "WebSiphon\/next-0.1",
"request_line": "GET \/.s3cfg HTTP\/1.1",
"request_sample": "GET \/.s3cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400\r\n\r\n",
"payload_snippet": "GET \/.s3cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "78411c5cb948fa8e92521de31bfbd88d7018f56f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.s3cfg",
"request_line": "GET \/.s3cfg HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.s3cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.s3cfg",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0043 \u2014 confiance 52 % \u2014 via HTTP",
"confidence_pct": 52,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9400,
"protocol_emulated": null,
"tags_summary": [
"INT-beh-scan-burst"
],
"tags_summary_labels_fr": [
"Beh Scan Burst"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.s3cfg",
"request_line": "GET \/.s3cfg HTTP\/1.1",
"http_user_agent": "WebSiphon\/next-0.1",
"port": 9400,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:9400 \u00b7 (reconnaissance) \u00b7 \u2192 \/.s3cfg",
"evidence_snippet": "GET \/.s3cfg HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: WebSiphon\/next-0.1\r\naccept-encoding: gzip,deflate,br\r\nhost: 62.3.50.33:9400",
"target_port_label": "9400 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (52 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 52 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9400"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|