|
|
TCP |
1234 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:1234 · (tentative d'exploit)
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
1234
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 1234,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3c1f11e9377347cdbfeab3f2adcb57588d74222a",
"event_fingerprint": "d657504e36867f383ad978de2291163a77a171a4",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 1234,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f03b35d0c80a63cdf4022756b05a8bc3f082f8c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 1234,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:1234 \u00b7 (tentative d'exploit)",
"target_port_label": "1234 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1234,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 1234,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:1234 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "1234 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1234"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
1234 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:1234 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
1234
Chemin / cible
—
Service
TLS
Payload
� �F�<�J���[p�XI�4� ]l�M� � D�jm� >���j��H����x /Mx66u�$ ��"� �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �F�<�J���[p�XI�4� ]l�M� � D�jm� >���j��H����x /Mx66u�$ ��"� �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� �F�<�J���[p�XI�4� ]l�M� � D�jm� >���j��H����x /Mx66u�$ ��"� �+�/�,�0̨̩� �� � c � ��� 2 + 3����t��� IwT�q�e��&��Y
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.740661369041249,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 1234,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "6332551f5bd79ec3119f5b9f286887dffc583d07",
"event_fingerprint": "920f838b24b788ae9a34235d6d120ce8213479f4",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "1944a64c7cf4e2fd45cf1cc68a1878a0",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 1234,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003F\ufffd<\ufffdJ\ufffd\ufffd\ufffd[p\ufffd\u0007XI\ufffd4\ufffd\f]l\ufffdM\ufffd \ufffd\u0000D\ufffdjm\ufffd \u0007>\ufffd\ufffd\ufffdj\ufffd\u0003\u0015\u0016\ufffdH\ufffd\u0004\ufffd\ufffd\ufffdx\u000b\/Mx66u\ufffd$\f\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003F\ufffd<\ufffdJ\ufffd\ufffd\ufffd[p\ufffd\u0007XI\ufffd4\ufffd\f]l\ufffdM\ufffd \ufffd\u0000D\ufffdjm\ufffd \u0007>\ufffd\ufffd\ufffdj\ufffd\u0003\u0015\u0016\ufffdH\ufffd\u0004\ufffd\ufffd\ufffdx\u000b\/Mx66u\ufffd$\f\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdt\ufffd\ufffd\ufffd\u0001\u001cIwT\ufffdq\ufffd\u0016e\ufffd\ufffd\u0014&\ufffd\ufffdY",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003F\ufffd<\ufffdJ\ufffd\ufffd\ufffd[p\ufffd\u0007XI\ufffd4\ufffd\f]l\ufffdM\ufffd \ufffd\u0000D\ufffdjm\ufffd \u0007>\ufffd\ufffd\ufffdj\ufffd\u0003\u0015\u0016\ufffdH\ufffd\u0004\ufffd\ufffd\ufffdx\u000b\/Mx66u\ufffd$\f\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bdc21c63396eb1633fab942114e4d6b34ff30aad",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003F\ufffd<\ufffdJ\ufffd\ufffd\ufffd[p\ufffd\u0007XI\ufffd4\ufffd\f]l\ufffdM\ufffd \ufffd\u0000D\ufffdjm\ufffd \u0007>\ufffd\ufffd\ufffdj\ufffd\u0003\u0015\u0016\ufffdH\ufffd\u0004\ufffd\ufffd\ufffdx\u000b\/Mx66u\ufffd$\f\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 1234,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdF\ufffd<\ufffdJ\ufffd\ufffd\ufffd[p\ufffdXI\ufffd4\ufffd]l\ufffdM\ufffd \ufffdD\ufffdjm\ufffd >\ufffd\ufffd\ufffdj\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdx\/Mx66u\ufffd$\ufffd\ufffd\"\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:1234 \u00b7 (sonde \/ probe)",
"target_port_label": "1234 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 1234,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003F\ufffd<\ufffdJ\ufffd\ufffd\ufffd[p\ufffd\u0007XI\ufffd4\ufffd\f]l\ufffdM\ufffd \ufffd\u0000D\ufffdjm\ufffd \u0007>\ufffd\ufffd\ufffdj\ufffd\u0003\u0015\u0016\ufffdH\ufffd\u0004\ufffd\ufffd\ufffdx\u000b\/Mx66u\ufffd$\f\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 1234,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:1234 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdF\ufffd<\ufffdJ\ufffd\ufffd\ufffd[p\ufffdXI\ufffd4\ufffd]l\ufffdM\ufffd \ufffdD\ufffdjm\ufffd >\ufffd\ufffd\ufffdj\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffdx\/Mx66u\ufffd$\ufffd\ufffd\"\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "1234 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "1234"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
27017 · MONGODB
|
mongodb
|
Protocole wire MongoDB
mongodb wire protocol · via MONGODB:27017 · (sonde / probe)
|
Élevée
|
Moyen · 43
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MONGODB
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mongodb_emulated
mongodb_wire_protocol
mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
27017
Chemin / cible
—
Service
MONGODB
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « mongodb_wire_protocol » (signaux protocolaires) · confiance 80%
Confiance classification
80%
Risque capteur
Moyen
· 43
Confiance : Confiance 80 % — 5 signal(aux) capteur
Protocole émulé
1
Signaux
ET-PROTO-MongoDB-Wire
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "3e000000000000000100000000000000dd070000000000001600000001000000000000001069736d6173746572000100000000016f6b0000000000f03f00",
"emulator_response_len": 62,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "mongodb",
"app_proto": "mongodb",
"asn": 32475,
"country": "US",
"dst_port": 27017,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 46,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 25
},
"risk_score": 43,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "937ec695b377cda38207574b50416d0b01631fa9",
"event_fingerprint": "3d0cef10d983b0efd34b4cdcc0b7c5f8287f4783",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
"confidence": 0.8,
"classification_confidence": 0.8,
"precision_score": 90,
"precision_signals": [
"ET-PROTO-MongoDB-Wire",
"INT-upstream"
],
"kb_rule_ids": [
"ET-PROTO-MongoDB-Wire",
"INT-upstream"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 25,
"risk_score": 43
},
"named_classification_skipped": false,
"classification_parent": "mongodb_probe",
"service_name": "mongodb",
"risk_confidence_factor": 80,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "9060bd55aeb34075959b54fecab264ea"
},
"target_context": {
"dst_port": 27017,
"service": "mongodb",
"service_name": "mongodb",
"risk_score": 43
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"database_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e4700fb27b11a0ea7f27b8f0043c0326c36da950",
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
"classification_reason_label_fr": "Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 80%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 43\/100",
"confidence_pct": 80,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 25,
"risk_score": 43
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "mongodb",
"service_label_fr": "MONGODB",
"dst_port": 27017,
"protocol_emulated": true,
"tags_summary": [
"ET-PROTO-MongoDB-Wire",
"INT-upstream"
],
"tags_summary_labels_fr": [
"ET-PROTO-MongoDB-Wire",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-mongodb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"mongodb_wire_fr": "Protocole wire MongoDB (OP_QUERY\/OP_MSG)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 27017,
"service": "mongodb",
"service_label_fr": "MONGODB"
},
"attack_vector": "mongodb wire protocol \u00b7 via MONGODB:27017 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "27017 \u00b7 MONGODB",
"emulator_service": "mongodb",
"confidence_reason": "Confiance 80 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 80 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "mongodb",
"service_banner": "honeypot-mongodb",
"service_os": "linux",
"dst_port": "27017"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mongodb_emulated",
"mongodb_wire_protocol",
"mozi_pattern",
"net_mongodb_wire_protocol"
]
}
|
|
|
TCP |
8 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 8,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1643bbc076030b411a22d0b7ee87a4e714e55c0f",
"event_fingerprint": "dbcdff50984cb5819bce4389656c64aeb03eefb6",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f576fb14534be9a29930284070fcf10f7e9f90fa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:8 \u00b7 (tentative d'exploit)",
"target_port_label": "8 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "8 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
8 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:8 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8
Chemin / cible
—
Service
TLS
Payload
� ��v�d�S�Lp�4���9W ��DD� ~^��, w�l�BϹ�l��-�p��K��v p�Puc�i �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��v�d�S�Lp�4���9W ��DD� ~^��, w�l�BϹ�l��-�p��K��v p�Puc�i �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� ��v�d�S�Lp�4���9W ��DD� ~^��, w�l�BϹ�l��-�p��K��v p�Puc�i �+�/�,�0̨̩� �� � c � ��� 2 + 3���� I�* f�<�Ҷ�3�m�z�$
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.73745114396462,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 8,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9fc1f6f6edb1c1664e5d0fa2f2228e34afe6cee8",
"event_fingerprint": "60c5fa687da5a6347f621096df5fc30c774b9e5f",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "43c1235bff7b5b8376b01e78a097ee90",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\bv\ufffdd\ufffdS\ufffdLp\ufffd4\ufffd\ufffd\ufffd9W\u001e\ufffd\u0018\ufffd\u000fDD\ufffd\u0000~^\ufffd\ufffd\u0014, w\ufffdl\ufffdB\u03f9\ufffdl\ufffd\ufffd-\ufffdp\ufffd\u0005\ufffd\u0013K\u0013\ufffd\ufffdv\u001cp\ufffdPuc\ufffdi\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\bv\ufffdd\ufffdS\ufffdLp\ufffd4\ufffd\ufffd\ufffd9W\u001e\ufffd\u0018\ufffd\u000fDD\ufffd\u0000~^\ufffd\ufffd\u0014, w\ufffdl\ufffdB\u03f9\ufffdl\ufffd\ufffd-\ufffdp\ufffd\u0005\ufffd\u0013K\u0013\ufffd\ufffdv\u001cp\ufffdPuc\ufffdi\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u001fI\ufffd*\ff\ufffd<\ufffd\u04b6\ufffd3\ufffdm\ufffdz\ufffd$\b\u001d",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\bv\ufffdd\ufffdS\ufffdLp\ufffd4\ufffd\ufffd\ufffd9W\u001e\ufffd\u0018\ufffd\u000fDD\ufffd\u0000~^\ufffd\ufffd\u0014, w\ufffdl\ufffdB\u03f9\ufffdl\ufffd\ufffd-\ufffdp\ufffd\u0005\ufffd\u0013K\u0013\ufffd\ufffdv\u001cp\ufffdPuc\ufffdi\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6723eaf24ed6177456bfd4e30478909045bfc19e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\bv\ufffdd\ufffdS\ufffdLp\ufffd4\ufffd\ufffd\ufffd9W\u001e\ufffd\u0018\ufffd\u000fDD\ufffd\u0000~^\ufffd\ufffd\u0014, w\ufffdl\ufffdB\u03f9\ufffdl\ufffd\ufffd-\ufffdp\ufffd\u0005\ufffd\u0013K\u0013\ufffd\ufffdv\u001cp\ufffdPuc\ufffdi\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 8,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdv\ufffdd\ufffdS\ufffdLp\ufffd4\ufffd\ufffd\ufffd9W\ufffd\ufffdDD\ufffd~^\ufffd\ufffd, w\ufffdl\ufffdB\u03f9\ufffdl\ufffd\ufffd-\ufffdp\ufffd\ufffdK\ufffd\ufffdvp\ufffdPuc\ufffdi\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:8 \u00b7 (sonde \/ probe)",
"target_port_label": "8 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\bv\ufffdd\ufffdS\ufffdLp\ufffd4\ufffd\ufffd\ufffd9W\u001e\ufffd\u0018\ufffd\u000fDD\ufffd\u0000~^\ufffd\ufffd\u0014, w\ufffdl\ufffdB\u03f9\ufffdl\ufffd\ufffd-\ufffdp\ufffd\u0005\ufffd\u0013K\u0013\ufffd\ufffdv\u001cp\ufffdPuc\ufffdi\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 8,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdv\ufffdd\ufffdS\ufffdLp\ufffd4\ufffd\ufffd\ufffd9W\ufffd\ufffdDD\ufffd~^\ufffd\ufffd, w\ufffdl\ufffdB\u03f9\ufffdl\ufffd\ufffd-\ufffdp\ufffd\ufffdK\ufffd\ufffdvp\ufffdPuc\ufffdi\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "8 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
2365 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:2365 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2365
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 56
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 2365,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d15822dd994302e494e265cb64eaf853bee5ce6b",
"event_fingerprint": "7853615aba24bccb606b06535f37d5a9f3cda66e",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2365,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d11fe1b331779c2dcd0f1f471fc13b8dd9a5b51",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 2365,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:2365 \u00b7 (tentative d'exploit)",
"target_port_label": "2365 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2365,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 2365,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:2365 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "2365 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2365"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
2365 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:2365 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2365
Chemin / cible
—
Service
TLS
Payload
� ���ZB��D ��:R��� vF�����0 x����1� 7�e����pH],��k�q�f��� �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���ZB��D ��:R��� vF�����0 x����1� 7�e����pH],��k�q�f��� �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� ���ZB��D ��:R��� vF�����0 x����1� 7�e����pH],��k�q�f��� �+�/�,�0̨̩� �� � c � ��� 2 + 3�������Cȑ�&��$0X����*�
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.722438567365112,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 2365,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "142f9f9d39721a0f9fb660776ecd8711992d0f44",
"event_fingerprint": "8e31b41c5e7f78f4a5b9c6a6b9b67105feef5454",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "5f23fcbe5319d921264a2bc05104a30a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2365,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0006\ufffd\ufffd\u0006Z\u0003B\ufffd\ufffdD\u001f\ufffd\ufffd:R\ufffd\ufffd\ufffd\fvF\b\u0004\ufffd\ufffd\ufffd\u0001\ufffd\ufffd0\u0004 x\ufffd\ufffd\ufffd\ufffd1\ufffd\u001f\u00147\ufffde\ufffd\ufffd\ufffd\ufffdpH],\ufffd\ufffdk\ufffdq\ufffd\u0002f\ufffd\u0018\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0006\ufffd\ufffd\u0006Z\u0003B\ufffd\ufffdD\u001f\ufffd\ufffd:R\ufffd\ufffd\ufffd\fvF\b\u0004\ufffd\ufffd\ufffd\u0001\ufffd\ufffd0\u0004 x\ufffd\ufffd\ufffd\ufffd1\ufffd\u001f\u00147\ufffde\ufffd\ufffd\ufffd\ufffdpH],\ufffd\ufffdk\ufffdq\ufffd\u0002f\ufffd\u0018\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffdC\u0211\ufffd&\ufffd\ufffd$0X\ufffd\ufffd\ufffd\u0011\u0011\ufffd*\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0006\ufffd\ufffd\u0006Z\u0003B\ufffd\ufffdD\u001f\ufffd\ufffd:R\ufffd\ufffd\ufffd\fvF\b\u0004\ufffd\ufffd\ufffd\u0001\ufffd\ufffd0\u0004 x\ufffd\ufffd\ufffd\ufffd1\ufffd\u001f\u00147\ufffde\ufffd\ufffd\ufffd\ufffdpH],\ufffd\ufffdk\ufffdq\ufffd\u0002f\ufffd\u0018\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "542b86b7ec0fd5c5f635e80d6694706a728c3ccf",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0006\ufffd\ufffd\u0006Z\u0003B\ufffd\ufffdD\u001f\ufffd\ufffd:R\ufffd\ufffd\ufffd\fvF\b\u0004\ufffd\ufffd\ufffd\u0001\ufffd\ufffd0\u0004 x\ufffd\ufffd\ufffd\ufffd1\ufffd\u001f\u00147\ufffde\ufffd\ufffd\ufffd\ufffdpH],\ufffd\ufffdk\ufffdq\ufffd\u0002f\ufffd\u0018\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 2365,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdZB\ufffd\ufffdD\ufffd\ufffd:R\ufffd\ufffd\ufffdvF\ufffd\ufffd\ufffd\ufffd\ufffd0 x\ufffd\ufffd\ufffd\ufffd1\ufffd7\ufffde\ufffd\ufffd\ufffd\ufffdpH],\ufffd\ufffdk\ufffdq\ufffdf\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:2365 \u00b7 (sonde \/ probe)",
"target_port_label": "2365 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 2365,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0006\ufffd\ufffd\u0006Z\u0003B\ufffd\ufffdD\u001f\ufffd\ufffd:R\ufffd\ufffd\ufffd\fvF\b\u0004\ufffd\ufffd\ufffd\u0001\ufffd\ufffd0\u0004 x\ufffd\ufffd\ufffd\ufffd1\ufffd\u001f\u00147\ufffde\ufffd\ufffd\ufffd\ufffdpH],\ufffd\ufffdk\ufffdq\ufffd\u0002f\ufffd\u0018\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 2365,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:2365 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdZB\ufffd\ufffdD\ufffd\ufffd:R\ufffd\ufffd\ufffdvF\ufffd\ufffd\ufffd\ufffd\ufffd0 x\ufffd\ufffd\ufffd\ufffd1\ufffd7\ufffde\ufffd\ufffd\ufffd\ufffdpH],\ufffd\ufffdk\ufffdq\ufffdf\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "2365 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "2365"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
19 · CHARGEN
|
chargen
|
Botnet Mozi
mozi pattern · via CHARGEN:19 · (commande & contrôle)
|
Élevée
|
Faible · 37
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
CHARGEN
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
19
Chemin / cible
—
Service
CHARGEN
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 37
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "4142434445464748494a4b4c4d4e4f505152535455565758595a6162636465666768696a6b6c6d6e6f707172737475767778797a303132333435363738390d0a",
"emulator_response_len": 64,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "chargen",
"app_proto": "chargen",
"asn": 32475,
"country": "US",
"dst_port": 19,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 37,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "4f04671f820e041a42bf2808ed7aa0b6ebd010fe",
"event_fingerprint": "e74872f7309216caab523de5e75544334ce9ed0b",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "chargen",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 19,
"service": "chargen",
"service_name": "chargen",
"risk_score": 37
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "842af303fdd7e4cfcb419d805ceb0694870fdbb1",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 19,
"service": "chargen",
"service_label_fr": "CHARGEN"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "mozi pattern \u00b7 via CHARGEN:19 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "19 \u00b7 CHARGEN",
"emulator_service": "chargen",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0011 \u2014 via CHARGEN",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "chargen",
"service_label_fr": "CHARGEN",
"dst_port": 19,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-chargen",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 19,
"service": "chargen",
"service_label_fr": "CHARGEN"
},
"attack_vector": "mozi pattern \u00b7 via CHARGEN:19 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "19 \u00b7 CHARGEN",
"emulator_service": "chargen",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "chargen",
"service_banner": "honeypot-chargen",
"service_os": "linux",
"dst_port": "19"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
16667 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:16667 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
16667
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 16667,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9eb57b95660bc99f0c7ac5d19a00e7cba04d6efe",
"event_fingerprint": "1833e7e88fc27ea09728c0d77052fdcc63fc2381",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 16667,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "346c1efca617b6f670b2e535fe20fc861163d8c6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 16667,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:16667 \u00b7 (tentative d'exploit)",
"target_port_label": "16667 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 16667,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 16667,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:16667 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "16667 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "16667"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
16667 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:16667 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
16667
Chemin / cible
—
Service
TLS
Payload
� �n��[��q�h�s �� qn�D'u�V���P�F{ E8�Z{�?T��������4���$�C+ A @ �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �n��[��q�h�s �� qn�D'u�V���P�F{ E8�Z{�?T��������4���$�C+ A @ �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� �n��[��q�h�s �� qn�D'u�V���P�F{ E8�Z{�?T��������4���$�C+ A @ �+�/�,�0̨̩� �� � c � ��� 2 + 3����υ�%a�0�q�C��糖a�<
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.712779743170757,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 16667,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5a639669708bb97cf3fd6e801e248f3092476084",
"event_fingerprint": "97cacf7b7f55567ab2c19ae66a359eddb583a3fa",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "988142e822e280ae014dbc1efa149375",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 16667,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003n\ufffd\ufffd[\ufffd\ufffdq\ufffdh\ufffd\u0015s\u0000\ufffd\ufffd qn\ufffdD'u\ufffdV\ufffd\ufffd\ufffdP\ufffdF{ E8\ufffdZ{\ufffd\u0003?T\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd$\ufffdC+\u000bA\f@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003n\ufffd\ufffd[\ufffd\ufffdq\ufffdh\ufffd\u0015s\u0000\ufffd\ufffd qn\ufffdD'u\ufffdV\ufffd\ufffd\ufffdP\ufffdF{ E8\ufffdZ{\ufffd\u0003?T\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd$\ufffdC+\u000bA\f@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u03c5\ufffd%a\ufffd0\ufffdq\ufffd\bC\ufffd\u0019\ufffd\ufa03a\ufffd<",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003n\ufffd\ufffd[\ufffd\ufffdq\ufffdh\ufffd\u0015s\u0000\ufffd\ufffd qn\ufffdD'u\ufffdV\ufffd\ufffd\ufffdP\ufffdF{ E8\ufffdZ{\ufffd\u0003?T\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd$\ufffdC+\u000bA\f@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "862b4c7c89e5cfb2d03ddc9b7a373d6a5729619b",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003n\ufffd\ufffd[\ufffd\ufffdq\ufffdh\ufffd\u0015s\u0000\ufffd\ufffd qn\ufffdD'u\ufffdV\ufffd\ufffd\ufffdP\ufffdF{ E8\ufffdZ{\ufffd\u0003?T\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd$\ufffdC+\u000bA\f@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 16667,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdn\ufffd\ufffd[\ufffd\ufffdq\ufffdh\ufffds\ufffd\ufffd qn\ufffdD'u\ufffdV\ufffd\ufffd\ufffdP\ufffdF{ E8\ufffdZ{\ufffd?T\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd$\ufffdC+A@\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:16667 \u00b7 (sonde \/ probe)",
"target_port_label": "16667 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 16667,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003n\ufffd\ufffd[\ufffd\ufffdq\ufffdh\ufffd\u0015s\u0000\ufffd\ufffd qn\ufffdD'u\ufffdV\ufffd\ufffd\ufffdP\ufffdF{ E8\ufffdZ{\ufffd\u0003?T\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd$\ufffdC+\u000bA\f@\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 16667,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:16667 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdn\ufffd\ufffd[\ufffd\ufffdq\ufffdh\ufffds\ufffd\ufffd qn\ufffdD'u\ufffdV\ufffd\ufffd\ufffdP\ufffdF{ E8\ufffdZ{\ufffd?T\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd$\ufffdC+A@\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "16667 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "16667"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Botnet Mozi
mozi pattern · via KERBEROS:88 · (commande & contrôle)
|
Élevée
|
Faible · 38
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 38
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 32475,
"country": "US",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "68890cc80ee52b8bd6dfeedd3db3b6108c4ecada",
"event_fingerprint": "26f82f2c92284ed572a3b340dbd905b8440e59b6",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4516342ed6158bbc86b9e7b2ee02c37d7d4bbe34",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "mozi pattern \u00b7 via KERBEROS:88 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0011 \u2014 via KERBEROS",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "mozi pattern \u00b7 via KERBEROS:88 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
8015 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8015 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8015
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 8015,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1e5f14c594b68ff1ba4c44bcdbac73693283f6db",
"event_fingerprint": "639b0e1c9bb16f75029bd716ae76bfa3bd78e03e",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8015,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69ee9a726e695c7d405853977e64bc49ffdc4459",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8015,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:8015 \u00b7 (tentative d'exploit)",
"target_port_label": "8015 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8015,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8015,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8015 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "8015 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8015"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
8015 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:8015 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8015
Chemin / cible
—
Service
TLS
Payload
� ��-h�>�<���M��p N-ߨ�_y����� �tW��+j���t?����|�~[��1��W8 �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��-h�>�<���M��p N-ߨ�_y�����
�tW��+j���t?����|�~[��1��W8 �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� ��-h�>�<���M��p N-ߨ�_y����� �tW��+j���t?����|�~[��1��W8 �+�/�,�0̨̩� �� � c � ��� 2 + 3����a<T�'�V��B���9�H+
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.707308498101561,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 8015,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "5170637da257ed4f49479a3a407939856bf5fcc9",
"event_fingerprint": "d5a4213f922dddbf37ec855710abb8840bfaa92c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "baff7a7b54d76dcaffde938d9aae8148",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8015,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd-h\ufffd\u0010>\ufffd<\ufffd\ufffd\ufffdM\ufffd\u0005\ufffdp\tN-\u07e8\u0012\ufffd_y\ufffd\ufffd\ufffd\ufffd\ufffd\n \ufffdtW\ufffd\ufffd\u0016+\u0017j\ufffd\ufffd\ufffdt?\ufffd\ufffd\ufffd\u0019\u0018\ufffd|\ufffd~\u001b[\ufffd\ufffd1\ufffd\ufffdW8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd-h\ufffd\u0010>\ufffd<\ufffd\ufffd\ufffdM\ufffd\u0005\ufffdp\tN-\u07e8\u0012\ufffd_y\ufffd\ufffd\ufffd\ufffd\ufffd\n \ufffdtW\ufffd\ufffd\u0016+\u0017j\ufffd\ufffd\ufffdt?\ufffd\ufffd\ufffd\u0019\u0018\ufffd|\ufffd~\u001b[\ufffd\ufffd1\ufffd\ufffdW8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffda<T\ufffd'\ufffdV\ufffd\ufffd\u0019B\ufffd\ufffd\ufffd9\ufffdH+\u001c\u05fc",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd-h\ufffd\u0010>\ufffd<\ufffd\ufffd\ufffdM\ufffd\u0005\ufffdp\tN-\u07e8\u0012\ufffd_y\ufffd\ufffd\ufffd\ufffd\ufffd\n \ufffdtW\ufffd\ufffd\u0016+\u0017j\ufffd\ufffd\ufffdt?\ufffd\ufffd\ufffd\u0019\u0018\ufffd|\ufffd~\u001b[\ufffd\ufffd1\ufffd\ufffdW8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94c33c69b082aa5f2010bf379bf08b49c9a0b44e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd-h\ufffd\u0010>\ufffd<\ufffd\ufffd\ufffdM\ufffd\u0005\ufffdp\tN-\u07e8\u0012\ufffd_y\ufffd\ufffd\ufffd\ufffd\ufffd\n \ufffdtW\ufffd\ufffd\u0016+\u0017j\ufffd\ufffd\ufffdt?\ufffd\ufffd\ufffd\u0019\u0018\ufffd|\ufffd~\u001b[\ufffd\ufffd1\ufffd\ufffdW8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 8015,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd-h\ufffd>\ufffd<\ufffd\ufffd\ufffdM\ufffd\ufffdp\tN-\u07e8\ufffd_y\ufffd\ufffd\ufffd\ufffd\ufffd\n \ufffdtW\ufffd\ufffd+j\ufffd\ufffd\ufffdt?\ufffd\ufffd\ufffd\ufffd|\ufffd~[\ufffd\ufffd1\ufffd\ufffdW8\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:8015 \u00b7 (sonde \/ probe)",
"target_port_label": "8015 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 8015,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd-h\ufffd\u0010>\ufffd<\ufffd\ufffd\ufffdM\ufffd\u0005\ufffdp\tN-\u07e8\u0012\ufffd_y\ufffd\ufffd\ufffd\ufffd\ufffd\n \ufffdtW\ufffd\ufffd\u0016+\u0017j\ufffd\ufffd\ufffdt?\ufffd\ufffd\ufffd\u0019\u0018\ufffd|\ufffd~\u001b[\ufffd\ufffd1\ufffd\ufffdW8\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 8015,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:8015 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd-h\ufffd>\ufffd<\ufffd\ufffd\ufffdM\ufffd\ufffdp\tN-\u07e8\ufffd_y\ufffd\ufffd\ufffd\ufffd\ufffd\n \ufffdtW\ufffd\ufffd+j\ufffd\ufffd\ufffdt?\ufffd\ufffd\ufffd\ufffd|\ufffd~[\ufffd\ufffd1\ufffd\ufffdW8\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "8015 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "8015"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
5432 · POSTGRES
|
postgres
|
Sonde PostgreSQL
postgresql probe · via POSTGRES:5432 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Handshake PostgreSQL (startup)
Émulateur
POSTGRES
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_postgresql_probe
postgres_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5432
Chemin / cible
—
Service
POSTGRES
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « postgresql_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "postgres",
"app_proto": "postgres",
"asn": 32475,
"country": "US",
"dst_port": 5432,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 46,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15
},
"risk_score": 34,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "7f7db99e5caf82bb59c1068ec217caeb7a57946a",
"event_fingerprint": "4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f",
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "postgres",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "2e6f775d89e58a7f725edffbb3ac7743"
},
"target_context": {
"dst_port": 5432,
"service": "postgres",
"service_name": "postgres",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a35f62b308547be6410c560e005165183198a5a",
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 5432,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)",
"target_port_label": "5432 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 46,
"novelty": 15,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "postgres",
"service_label_fr": "POSTGRES",
"dst_port": 5432,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "PostgreSQL 15.4",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"postgres_startup_fr": "Handshake PostgreSQL (startup)",
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 5432,
"service": "postgres",
"service_label_fr": "POSTGRES"
},
"attack_vector": "postgresql probe \u00b7 via POSTGRES:5432 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "5432 \u00b7 POSTGRES",
"emulator_service": "postgres",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "postgres",
"service_banner": "PostgreSQL 15.4",
"service_os": "linux",
"dst_port": "5432"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_postgresql_probe",
"postgres_emulated"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8080 · (tentative d'exploit)
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 8080,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 25
},
"risk_score": 58,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "a5c5963ae9943b38b4077add13a689c9b45f71f7",
"event_fingerprint": "dd1c33b3ddd8f77e8ab82a7f46dcc7a24e21174d",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 25,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3edf8d476b1cf68131c8a1b6262d727cf9af1c0d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 25,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
]
}
|
|
|
TCP |
8080 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8080 · (tentative d'exploit) · → /favicon.ico
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /favicon.ico UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/favicon.ico
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 54
Confiance : Confiance 50 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600",
"emulator_response_len": 130,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 176,
"payload_entropy": 5.2055424095882366,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 8080,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9585a195073a27e014a113facb4d0d764adf6c54",
"event_fingerprint": "81acb3acbef6fd7d4af6401e1b6561de8d6135eb",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "928108b57c06b304269c1aaa93d4975d28c060fb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"attack_vector": "ssrf attack \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
8002 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8002 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8002
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 56
Confiance : Confiance 50 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 8002,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 25
},
"risk_score": 56,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "5c11a832a081e9cb2de4c8117520260ed7ed7b6e",
"event_fingerprint": "d2a3214c59976b45f896567f1a42f7533d513f19",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "270eada1538ea84325437bc439f69007a85affaa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit)",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
]
}
|
|
|
TCP |
8002 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:8002 · (tentative d'exploit) · → /favicon.ico
|
Élevée
|
Moyen · 51
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /favicon.ico UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8002
Chemin / cible
/favicon.ico
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 51
Confiance : Confiance 50 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600",
"emulator_response_len": 130,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 176,
"payload_entropy": 5.2055424095882366,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 8002,
"risk_waf": 84,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "817b3832578b29d9cca16fc017931264d516f230",
"event_fingerprint": "11c2655f13c868e87bc6c4f24afa6d74f69ced63",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 51
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "599bc0f2a07a18ca401c274c2ded24b87fba5150",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"attack_vector": "ssrf attack \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 84,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 51
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
9 · DISCARD
|
discard
|
Botnet Mozi
mozi pattern · via DISCARD:9 · (commande & contrôle)
|
Élevée
|
Faible · 36
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
DISCARD
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9
Chemin / cible
—
Service
DISCARD
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "discard",
"app_proto": "discard",
"asn": 32475,
"country": "US",
"dst_port": 9,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 36,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "13132f78576b0f05a7c5c1104537faa1596cdfe4",
"event_fingerprint": "1e22b5f144390eb6ece74ed9380fb3713823375a",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "discard",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 9,
"service": "discard",
"service_name": "discard",
"risk_score": 36
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d25082ad004a4ca7a4cf926b98b6898aa1d16d5e",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 9,
"service": "discard",
"service_label_fr": "DISCARD"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "mozi pattern \u00b7 via DISCARD:9 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "9 \u00b7 DISCARD",
"emulator_service": "discard",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via DISCARD",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "discard",
"service_label_fr": "DISCARD",
"dst_port": 9,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-discard",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 9,
"service": "discard",
"service_label_fr": "DISCARD"
},
"attack_vector": "mozi pattern \u00b7 via DISCARD:9 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "9 \u00b7 DISCARD",
"emulator_service": "discard",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "discard",
"service_banner": "honeypot-discard",
"service_os": "linux",
"dst_port": "9"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
2 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:2 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2
Chemin / cible
—
Service
TLS
Payload
� �_���#�\�� �����̐�@ ����� `5��!|Ƥ��d�]u� ��,�2��rVyo �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �_���#�\�� �����̐�@ �����
`5��!|Ƥ��d�]u� ��,�2��rVyo �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� �_���#�\�� �����̐�@ ����� `5��!|Ƥ��d�]u� ��,�2��rVyo �+�/�,�0̨̩� �� � c � ��� 2 + 3������<�����B�+�_��O�Â
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.7314332901869305,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 2,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "6531e424f048baf2435a61e7140ae409865e0b49",
"event_fingerprint": "9329c00bc8b3e901ca02f0d00302750b833ef867",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "56ba09a0c69e75865712ecddcb4a7859",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 2,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003_\ufffd\ufffd\ufffd#\ufffd\\\u0015\ufffd\ufffd\u001e\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u0310\ufffd@\u0006\u0019\u001e\ufffd\u0018\ufffd\ufffd\ufffd\ufffd\r `5\u0015\ufffd\b\ufffd!|\u01a4\ufffd\ufffdd\u0011\ufffd]u\ufffd \ufffd\ufffd,\ufffd2\ufffd\ufffdrVyo\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003_\ufffd\ufffd\ufffd#\ufffd\\\u0015\ufffd\ufffd\u001e\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u0310\ufffd@\u0006\u0019\u001e\ufffd\u0018\ufffd\ufffd\ufffd\ufffd\r `5\u0015\ufffd\b\ufffd!|\u01a4\ufffd\ufffdd\u0011\ufffd]u\ufffd \ufffd\ufffd,\ufffd2\ufffd\ufffdrVyo\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0013\ufffd<\ufffd\ufffd\ufffd\u0018\ufffd\ufffdB\ufffd+\ufffd_\ufffd\ufffdO\ufffd\u00c2",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003_\ufffd\ufffd\ufffd#\ufffd\\\u0015\ufffd\ufffd\u001e\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u0310\ufffd@\u0006\u0019\u001e\ufffd\u0018\ufffd\ufffd\ufffd\ufffd\r `5\u0015\ufffd\b\ufffd!|\u01a4\ufffd\ufffdd\u0011\ufffd]u\ufffd \ufffd\ufffd,\ufffd2\ufffd\ufffdrVyo\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0feadc698e42509661937082b246f61d9e1ad4fe",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003_\ufffd\ufffd\ufffd#\ufffd\\\u0015\ufffd\ufffd\u001e\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u0310\ufffd@\u0006\u0019\u001e\ufffd\u0018\ufffd\ufffd\ufffd\ufffd\r `5\u0015\ufffd\b\ufffd!|\u01a4\ufffd\ufffdd\u0011\ufffd]u\ufffd \ufffd\ufffd,\ufffd2\ufffd\ufffdrVyo\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 2,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd_\ufffd\ufffd\ufffd#\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0310\ufffd@\ufffd\ufffd\ufffd\ufffd\ufffd\r `5\ufffd\ufffd!|\u01a4\ufffd\ufffdd\ufffd]u\ufffd \ufffd\ufffd,\ufffd2\ufffd\ufffdrVyo\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:2 \u00b7 (sonde \/ probe)",
"target_port_label": "2 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 2,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003_\ufffd\ufffd\ufffd#\ufffd\\\u0015\ufffd\ufffd\u001e\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\u0310\ufffd@\u0006\u0019\u001e\ufffd\u0018\ufffd\ufffd\ufffd\ufffd\r `5\u0015\ufffd\b\ufffd!|\u01a4\ufffd\ufffdd\u0011\ufffd]u\ufffd \ufffd\ufffd,\ufffd2\ufffd\ufffdrVyo\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 2,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:2 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd_\ufffd\ufffd\ufffd#\ufffd\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0310\ufffd@\ufffd\ufffd\ufffd\ufffd\ufffd\r `5\ufffd\ufffd!|\u01a4\ufffd\ufffdd\ufffd]u\ufffd \ufffd\ufffd,\ufffd2\ufffd\ufffdrVyo\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "2 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "2"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
2 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:2 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 54
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 2,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "774811c517057a7629ee96422eec8df7fddd1929",
"event_fingerprint": "4e845be95abbd3a74c24f430984a74921e5c047c",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c05b6aaf98f67ea8167adc454fba3391a8e9553",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 2,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:2 \u00b7 (tentative d'exploit)",
"target_port_label": "2 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 2,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:2 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "2 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
4 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:4 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 4,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5df671df3a26d49edbd54c84f9641aca38b7ce43",
"event_fingerprint": "84a6b5ab99f2805418baaaee1cef9f2629bc166e",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 4,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6cda0e1b521e4e1c820d55a30f522f76f10624c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 4,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:4 \u00b7 (tentative d'exploit)",
"target_port_label": "4 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 4,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:4 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "4 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
4 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:4 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4
Chemin / cible
—
Service
TLS
Payload
� �ա�v&9�����T�|���o�x-��w�`��:� ��s/���L8MK3��u���8x�Ō�$�F �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ա�v&9�����T�|���o�x-��w�`��:� ��s/���L8MK3��u���8x�Ō�$�F �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� �ա�v&9�����T�|���o�x-��w�`��:� ��s/���L8MK3��u���8x�Ō�$�F �+�/�,�0̨̩� �� � c � ��� 2 + 3�������WJ��A�����f���rU
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.730758430243314,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 4,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "bdfd5f794023835f2d5c49c178de6e4ba4b5d2c4",
"event_fingerprint": "1f31232491f184dc7903558b84a63f9a7abb7ec0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "2d3a114b87ef6227c801df95530cc6a1",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0561\ufffdv&9\ufffd\b\ufffd\ufffd\ufffd\ufffdT\ufffd|\ufffd\u0006\ufffd\ufffdo\ufffdx-\ufffd\ufffdw\ufffd`\ufffd\ufffd:\ufffd \ufffd\u001a\ufffds\u0017\/\ufffd\ufffd\ufffdL8MK3\ufffd\ufffdu\ufffd\ufffd\ufffd8x\ufffd\u014c\ufffd$\ufffdF\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0561\ufffdv&9\ufffd\b\ufffd\ufffd\ufffd\ufffdT\ufffd|\ufffd\u0006\ufffd\ufffdo\ufffdx-\ufffd\ufffdw\ufffd`\ufffd\ufffd:\ufffd \ufffd\u001a\ufffds\u0017\/\ufffd\ufffd\ufffdL8MK3\ufffd\ufffdu\ufffd\ufffd\ufffd8x\ufffd\u014c\ufffd$\ufffdF\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffdWJ\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\u0012\u0001\ufffdf\ufffd\ufffd\ufffdrU",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0561\ufffdv&9\ufffd\b\ufffd\ufffd\ufffd\ufffdT\ufffd|\ufffd\u0006\ufffd\ufffdo\ufffdx-\ufffd\ufffdw\ufffd`\ufffd\ufffd:\ufffd \ufffd\u001a\ufffds\u0017\/\ufffd\ufffd\ufffdL8MK3\ufffd\ufffdu\ufffd\ufffd\ufffd8x\ufffd\u014c\ufffd$\ufffdF\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c2f6950cbe9bd4a824988963200600464f796dc",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0561\ufffdv&9\ufffd\b\ufffd\ufffd\ufffd\ufffdT\ufffd|\ufffd\u0006\ufffd\ufffdo\ufffdx-\ufffd\ufffdw\ufffd`\ufffd\ufffd:\ufffd \ufffd\u001a\ufffds\u0017\/\ufffd\ufffd\ufffdL8MK3\ufffd\ufffdu\ufffd\ufffd\ufffd8x\ufffd\u014c\ufffd$\ufffdF\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 4,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\u0561\ufffdv&9\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd|\ufffd\ufffd\ufffdo\ufffdx-\ufffd\ufffdw\ufffd`\ufffd\ufffd:\ufffd \ufffd\ufffds\/\ufffd\ufffd\ufffdL8MK3\ufffd\ufffdu\ufffd\ufffd\ufffd8x\ufffd\u014c\ufffd$\ufffdF\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:4 \u00b7 (sonde \/ probe)",
"target_port_label": "4 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0561\ufffdv&9\ufffd\b\ufffd\ufffd\ufffd\ufffdT\ufffd|\ufffd\u0006\ufffd\ufffdo\ufffdx-\ufffd\ufffdw\ufffd`\ufffd\ufffd:\ufffd \ufffd\u001a\ufffds\u0017\/\ufffd\ufffd\ufffdL8MK3\ufffd\ufffdu\ufffd\ufffd\ufffd8x\ufffd\u014c\ufffd$\ufffdF\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 4,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:4 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u0561\ufffdv&9\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd|\ufffd\ufffd\ufffdo\ufffdx-\ufffd\ufffdw\ufffd`\ufffd\ufffd:\ufffd \ufffd\ufffds\/\ufffd\ufffd\ufffdL8MK3\ufffd\ufffdu\ufffd\ufffd\ufffd8x\ufffd\u014c\ufffd$\ufffdF\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "4 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Botnet Mozi
mozi pattern · via HTTPS:8443 · (commande & contrôle)
|
Élevée
|
Faible · 36
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
http_get_probe
mozi_pattern
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600",
"emulator_response_len": 130,
"bytes_in": 176,
"payload_entropy": 5.2055424095882366,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "https",
"app_proto": "https",
"asn": 32475,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 36,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2aa17a6b515596b20eaea8d57184d62da9f48dfc",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 36
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"evidence": {
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "91fc357fd71fd242b6eb0a3a86907107e9091bb5",
"protocol_details": {
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via HTTPS",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"http_get_probe",
"mozi_pattern",
"net_web_probe"
]
}
|
|
|
TCP |
8443 · HTTPS
|
https
|
Botnet Mozi
mozi pattern · via HTTPS:8443 · (commande & contrôle)
|
Élevée
|
Faible · 36
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
http_get_probe
mozi_pattern
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8443
Chemin / cible
—
Service
HTTPS
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 4 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "https",
"app_proto": "https",
"asn": 32475,
"country": "US",
"dst_port": 8443,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 36,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "2aa17a6b515596b20eaea8d57184d62da9f48dfc",
"event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 8443,
"service": "https",
"service_name": "https",
"risk_score": 36
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3386d8276d2322c532a0b29886bcbe687c3da254",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via HTTPS",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 8443,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 8443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "8443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "8443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"http_get_probe",
"mozi_pattern",
"net_web_probe"
]
}
|
|
|
TCP |
9845 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:9845 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9845
Chemin / cible
—
Service
TLS
Payload
� ��Ȅ�� �j�\�%�eg둆�(@1�_.d �Ri� �Q�T� .�64k��j�a1&Y�霵5� o� �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��Ȅ�� �j�\�%�eg둆�(@1�_.d �Ri� �Q�T� .�64k��j�a1&Y�霵5� o� �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� ��Ȅ�� �j�\�%�eg둆�(@1�_.d �Ri� �Q�T� .�64k��j�a1&Y�霵5� o� �+�/�,�0̨̩� �� � c � ��� 2 + 3��������k˘$,��8w(�\��"
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.72332238533992,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 9845,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "637af3f011caf455e2e105c8fe1d98b93f61cdee",
"event_fingerprint": "66212770f0e47e0f449b35a0cec67d3f37babf45",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "7886e98db8c462bd7f87f7f5b1582d7a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 9845,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0204\ufffd\ufffd\t\ufffdj\ufffd\\\ufffd%\u000f\ufffdeg\ub446\ufffd(@1\ufffd_.d\f\ufffdRi\ufffd \ufffdQ\ufffdT\ufffd\u001e.\ufffd64k\u0019\ufffd\ufffdj\ufffda1&Y\ufffd\u97355\u0003\ufffd\to\u001a\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0204\ufffd\ufffd\t\ufffdj\ufffd\\\ufffd%\u000f\ufffdeg\ub446\ufffd(@1\ufffd_.d\f\ufffdRi\ufffd \ufffdQ\ufffdT\ufffd\u001e.\ufffd64k\u0019\ufffd\ufffdj\ufffda1&Y\ufffd\u97355\u0003\ufffd\to\u001a\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffdk\u02d8$\u0004,\ufffd\ufffd8w(\ufffd\\\ufffd\ufffd\"\u001a",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0204\ufffd\ufffd\t\ufffdj\ufffd\\\ufffd%\u000f\ufffdeg\ub446\ufffd(@1\ufffd_.d\f\ufffdRi\ufffd \ufffdQ\ufffdT\ufffd\u001e.\ufffd64k\u0019\ufffd\ufffdj\ufffda1&Y\ufffd\u97355\u0003\ufffd\to\u001a\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72192db275d1b57647cb92fe76178d86259226bb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0204\ufffd\ufffd\t\ufffdj\ufffd\\\ufffd%\u000f\ufffdeg\ub446\ufffd(@1\ufffd_.d\f\ufffdRi\ufffd \ufffdQ\ufffdT\ufffd\u001e.\ufffd64k\u0019\ufffd\ufffdj\ufffda1&Y\ufffd\u97355\u0003\ufffd\to\u001a\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 9845,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\u0204\ufffd\ufffd\t\ufffdj\ufffd\\\ufffd%\ufffdeg\ub446\ufffd(@1\ufffd_.d\ufffdRi\ufffd \ufffdQ\ufffdT\ufffd.\ufffd64k\ufffd\ufffdj\ufffda1&Y\ufffd\u97355\ufffd\to\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:9845 \u00b7 (sonde \/ probe)",
"target_port_label": "9845 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 9845,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0204\ufffd\ufffd\t\ufffdj\ufffd\\\ufffd%\u000f\ufffdeg\ub446\ufffd(@1\ufffd_.d\f\ufffdRi\ufffd \ufffdQ\ufffdT\ufffd\u001e.\ufffd64k\u0019\ufffd\ufffdj\ufffda1&Y\ufffd\u97355\u0003\ufffd\to\u001a\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 9845,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:9845 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\u0204\ufffd\ufffd\t\ufffdj\ufffd\\\ufffd%\ufffdeg\ub446\ufffd(@1\ufffd_.d\ufffdRi\ufffd \ufffdQ\ufffdT\ufffd.\ufffd64k\ufffd\ufffdj\ufffda1&Y\ufffd\u97355\ufffd\to\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "9845 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "9845"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
9845 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:9845 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9845
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 9845,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a34b265ee77716afb46c70f9a9c7fb4079e635c7",
"event_fingerprint": "ce420c8735e6abe8caa8a18e02a05d2e3d455591",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9845,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6bb930330981b4163b7e9d6c885578673705104d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 9845,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:9845 \u00b7 (tentative d'exploit)",
"target_port_label": "9845 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9845,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 9845,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:9845 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "9845 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9845"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Sonde SAP ICM HTTP
Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_sap_web_probe
sap_icm_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 32475,
"country": "US",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 34,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f4d3bfae803bd07fc62331c16ac15c5323341684",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 34
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7336a3c83f33a9c9e6cc00e5d3645d7c3d1fa5ad",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
|
|
|
TCP |
8000 · SAP ICM
|
sap-icm
|
Sonde SAP ICM HTTP
Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_sap_web_probe
sap_icm_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc
Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 5 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/sc
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600",
"emulator_response_len": 130,
"bytes_in": 176,
"payload_entropy": 5.2055424095882366,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 32475,
"country": "US",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 34,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "f4d3bfae803bd07fc62331c16ac15c5323341684",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d56ec1d099a290ccb29eb2acc5ada1e0",
"path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 34
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"evidence": {
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f7886c2e6ac47b4d906df726a8a2ed8c264eb5d",
"protocol_details": {
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/sc",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
|
|
|
TCP |
5 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:5 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 5,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b6f89fe1bb4f6c93a9a68b53f28a63f1c2d59e1c",
"event_fingerprint": "e0b4d068221d243d11ea5b1f0ec3b334ecfb7e29",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97885d80f5674e5eb0d11f39ad9454abfa324f20",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 5,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:5 \u00b7 (tentative d'exploit)",
"target_port_label": "5 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 5,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:5 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "5 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
5 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:5 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5
Chemin / cible
—
Service
TLS
Payload
� ��n8��"�6�mi��LߐJ��1Xx��2]���j� >�~� �����W��5%���yI� {~ix�^a �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��n8��"�6�mi��LߐJ��1Xx��2]���j� >�~� �����W��5%���yI� {~ix�^a �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� ��n8��"�6�mi��LߐJ��1Xx��2]���j� >�~� �����W��5%���yI� {~ix�^a �+�/�,�0̨̩� �� � c � ��� 2 + 3����+$ �3�����q�q����
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.730410057644554,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 5,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9050334b46a5eba6a67d74830c9abf80c9f238c7",
"event_fingerprint": "572d8998cb9d8f4062077b4195e10e8931d5b073",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "74680fae0f49f75e54b488563193f004",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 5,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdn8\ufffd\ufffd\"\ufffd6\ufffdmi\ufffd\ufffdL\u07d0J\ufffd\u0001\ufffd1Xx\ufffd\ufffd2]\ufffd\ufffd\ufffdj\ufffd >\ufffd~\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd5%\ufffd\ufffd\u0003\ufffdyI\ufffd\u000b{~ix\ufffd^\u0015a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdn8\ufffd\ufffd\"\ufffd6\ufffdmi\ufffd\ufffdL\u07d0J\ufffd\u0001\ufffd1Xx\ufffd\ufffd2]\ufffd\ufffd\ufffdj\ufffd >\ufffd~\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd5%\ufffd\ufffd\u0003\ufffdyI\ufffd\u000b{~ix\ufffd^\u0015a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0010+$\u001f\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffdq\ufffd\ufffd\ufffd\u0011\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdn8\ufffd\ufffd\"\ufffd6\ufffdmi\ufffd\ufffdL\u07d0J\ufffd\u0001\ufffd1Xx\ufffd\ufffd2]\ufffd\ufffd\ufffdj\ufffd >\ufffd~\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd5%\ufffd\ufffd\u0003\ufffdyI\ufffd\u000b{~ix\ufffd^\u0015a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0cfc63f9f9de1c87e43e98f3e6c2df8c54b683c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdn8\ufffd\ufffd\"\ufffd6\ufffdmi\ufffd\ufffdL\u07d0J\ufffd\u0001\ufffd1Xx\ufffd\ufffd2]\ufffd\ufffd\ufffdj\ufffd >\ufffd~\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd5%\ufffd\ufffd\u0003\ufffdyI\ufffd\u000b{~ix\ufffd^\u0015a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 5,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdn8\ufffd\ufffd\"\ufffd6\ufffdmi\ufffd\ufffdL\u07d0J\ufffd\ufffd1Xx\ufffd\ufffd2]\ufffd\ufffd\ufffdj\ufffd >\ufffd~\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd5%\ufffd\ufffd\ufffdyI\ufffd{~ix\ufffd^a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:5 \u00b7 (sonde \/ probe)",
"target_port_label": "5 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 5,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdn8\ufffd\ufffd\"\ufffd6\ufffdmi\ufffd\ufffdL\u07d0J\ufffd\u0001\ufffd1Xx\ufffd\ufffd2]\ufffd\ufffd\ufffdj\ufffd >\ufffd~\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd5%\ufffd\ufffd\u0003\ufffdyI\ufffd\u000b{~ix\ufffd^\u0015a\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 5,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:5 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdn8\ufffd\ufffd\"\ufffd6\ufffdmi\ufffd\ufffdL\u07d0J\ufffd\ufffd1Xx\ufffd\ufffd2]\ufffd\ufffd\ufffdj\ufffd >\ufffd~\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd5%\ufffd\ufffd\ufffdyI\ufffd{~ix\ufffd^a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "5 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "5"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
83 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:83 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
83
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 83,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "713880a9e87061957c2a165d7c8e15b433d94302",
"event_fingerprint": "59997007a4b709d77b057e725a7b9a94d3749890",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 83,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7c6b3175db17f0894b525e1072a871e74b56695",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 83,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:83 \u00b7 (tentative d'exploit)",
"target_port_label": "83 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 83,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 83,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:83 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "83 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "83"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
83 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:83 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
83
Chemin / cible
—
Service
TLS
Payload
� ��N�W��H��0���m�Ga�,������ } ���|7�oֶ��" śQ=�!~�8�t��UM+ �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��N�W��H��0���m�Ga�,������ } ���|7�oֶ��" śQ=�!~�8�t��UM+ �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� ��N�W��H��0���m�Ga�,������ } ���|7�oֶ��" śQ=�!~�8�t��UM+ �+�/�,�0̨̩� �� � c � ��� 2 + 3����U�!��i��Z+cmy����
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.732708707568069,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 83,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "2d3dadbe3565d076bb6dc6b5abadacd957ca9090",
"event_fingerprint": "fa8f74759937d1bcd88ecb4cb119b54f42e10678",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "811e86fdc82f7a396bb4d332efa3eead",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 83,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdN\ufffdW\u000f\ufffd\ufffdH\ufffd\b\ufffd0\ufffd\ufffd\u0017\ufffdm\ufffdG\u0006a\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u001c} \ufffd\ufffd\ufffd|7\ufffdo\u05b6\ufffd\ufffd\"\u001d\u015bQ=\ufffd\u0002!~\ufffd8\ufffdt\ufffd\u0002\ufffdU\u0016M+\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdN\ufffdW\u000f\ufffd\ufffdH\ufffd\b\ufffd0\ufffd\ufffd\u0017\ufffdm\ufffdG\u0006a\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u001c} \ufffd\ufffd\ufffd|7\ufffdo\u05b6\ufffd\ufffd\"\u001d\u015bQ=\ufffd\u0002!~\ufffd8\ufffdt\ufffd\u0002\ufffdU\u0016M+\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdU\ufffd!\ufffd\ufffdi\ufffd\ufffdZ+cmy\ufffd\ufffd\u000f\ufffd\u0004\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdN\ufffdW\u000f\ufffd\ufffdH\ufffd\b\ufffd0\ufffd\ufffd\u0017\ufffdm\ufffdG\u0006a\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u001c} \ufffd\ufffd\ufffd|7\ufffdo\u05b6\ufffd\ufffd\"\u001d\u015bQ=\ufffd\u0002!~\ufffd8\ufffdt\ufffd\u0002\ufffdU\u0016M+\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99c9852110c89ab4b90ab781f56b2faf0a61bbdd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdN\ufffdW\u000f\ufffd\ufffdH\ufffd\b\ufffd0\ufffd\ufffd\u0017\ufffdm\ufffdG\u0006a\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u001c} \ufffd\ufffd\ufffd|7\ufffdo\u05b6\ufffd\ufffd\"\u001d\u015bQ=\ufffd\u0002!~\ufffd8\ufffdt\ufffd\u0002\ufffdU\u0016M+\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 83,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdN\ufffdW\ufffd\ufffdH\ufffd\ufffd0\ufffd\ufffd\ufffdm\ufffdGa\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t} \ufffd\ufffd\ufffd|7\ufffdo\u05b6\ufffd\ufffd\"\u015bQ=\ufffd!~\ufffd8\ufffdt\ufffd\ufffdUM+\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:83 \u00b7 (sonde \/ probe)",
"target_port_label": "83 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 83,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdN\ufffdW\u000f\ufffd\ufffdH\ufffd\b\ufffd0\ufffd\ufffd\u0017\ufffdm\ufffdG\u0006a\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\u001c} \ufffd\ufffd\ufffd|7\ufffdo\u05b6\ufffd\ufffd\"\u001d\u015bQ=\ufffd\u0002!~\ufffd8\ufffdt\ufffd\u0002\ufffdU\u0016M+\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 83,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:83 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdN\ufffdW\ufffd\ufffdH\ufffd\ufffd0\ufffd\ufffd\ufffdm\ufffdGa\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t} \ufffd\ufffd\ufffd|7\ufffdo\u05b6\ufffd\ufffd\"\u015bQ=\ufffd!~\ufffd8\ufffdt\ufffd\ufffdUM+\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "83 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "83"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
18888 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:18888 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
18888
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 56
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 18888,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3d44cfdcd0cdefab89f5179bb3936b8fcb0df14a",
"event_fingerprint": "191ac0ad8de9337365b0ef855b5014083bcfb60b",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 18888,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "957dc1a2bfbb235245af04375850c71be3fbd69e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit)",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18888,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
18888 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:18888 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
18888
Chemin / cible
—
Service
TLS
Payload
� �9�7 g?�`8?�(QS���X�?�7�D��#j�f� �vθO�4hI��#���n�n�g�K:�^ct1f �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �9�7 g?�`8?�(QS���X�?�7�D��#j�f�
�vθO�4hI��#���n�n�g�K:�^ct1f �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� �9�7 g?�`8?�(QS���X�?�7�D��#j�f� �vθO�4hI��#���n�n�g�K:�^ct1f �+�/�,�0̨̩� �� � c � ��� 2 + 3��������W��ژ��/x�+ �;�
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.719309790093312,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 18888,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "18deced0a5a4545a8fd6c1de8194470c31f93b70",
"event_fingerprint": "f7284696ebbffd68961b9c0be42bc89087856bb4",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "8261b3e42b85ff6840f38fafe39c69a4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 18888,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\ufffd7\tg?\ufffd`8?\ufffd(QS\ufffd\ufffd\u0018\ufffdX\ufffd?\ufffd7\ufffdD\ufffd\ufffd#j\ufffdf\ufffd \u0016\n\ufffdv\u03b8O\ufffd4hI\ufffd\ufffd#\ufffd\ufffd\ufffdn\ufffdn\ufffdg\ufffdK:\ufffd^ct\u00151f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\ufffd7\tg?\ufffd`8?\ufffd(QS\ufffd\ufffd\u0018\ufffdX\ufffd?\ufffd7\ufffdD\ufffd\ufffd#j\ufffdf\ufffd \u0016\n\ufffdv\u03b8O\ufffd4hI\ufffd\ufffd#\ufffd\ufffd\ufffdn\ufffdn\ufffdg\ufffdK:\ufffd^ct\u00151f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\u0698\ufffd\ufffd\/x\ufffd\u0001\u0016+\n\ufffd;\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\ufffd7\tg?\ufffd`8?\ufffd(QS\ufffd\ufffd\u0018\ufffdX\ufffd?\ufffd7\ufffdD\ufffd\ufffd#j\ufffdf\ufffd \u0016\n\ufffdv\u03b8O\ufffd4hI\ufffd\ufffd#\ufffd\ufffd\ufffdn\ufffdn\ufffdg\ufffdK:\ufffd^ct\u00151f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "61f70502e3457e430c22e9e048d06943fa972558",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\ufffd7\tg?\ufffd`8?\ufffd(QS\ufffd\ufffd\u0018\ufffdX\ufffd?\ufffd7\ufffdD\ufffd\ufffd#j\ufffdf\ufffd \u0016\n\ufffdv\u03b8O\ufffd4hI\ufffd\ufffd#\ufffd\ufffd\ufffdn\ufffdn\ufffdg\ufffdK:\ufffd^ct\u00151f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 18888,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd9\ufffd7\tg?\ufffd`8?\ufffd(QS\ufffd\ufffd\ufffdX\ufffd?\ufffd7\ufffdD\ufffd\ufffd#j\ufffdf\ufffd \n\ufffdv\u03b8O\ufffd4hI\ufffd\ufffd#\ufffd\ufffd\ufffdn\ufffdn\ufffdg\ufffdK:\ufffd^ct1f\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:18888 \u00b7 (sonde \/ probe)",
"target_port_label": "18888 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18888,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00039\ufffd7\tg?\ufffd`8?\ufffd(QS\ufffd\ufffd\u0018\ufffdX\ufffd?\ufffd7\ufffdD\ufffd\ufffd#j\ufffdf\ufffd \u0016\n\ufffdv\u03b8O\ufffd4hI\ufffd\ufffd#\ufffd\ufffd\ufffdn\ufffdn\ufffdg\ufffdK:\ufffd^ct\u00151f\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 18888,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:18888 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd9\ufffd7\tg?\ufffd`8?\ufffd(QS\ufffd\ufffd\ufffdX\ufffd?\ufffd7\ufffdD\ufffd\ufffd#j\ufffdf\ufffd \n\ufffdv\u03b8O\ufffd4hI\ufffd\ufffd#\ufffd\ufffd\ufffdn\ufffdn\ufffdg\ufffdK:\ufffd^ct1f\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "18888 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
3256 · SAP Diag
|
sap-diag
|
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via SAP Diag:3256 · (sonde / probe)
|
Élevée
|
Faible · 31
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
3256
Chemin / cible
—
Service
SAP Diag
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 31
Confiance : Confiance 0 % — 6 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 32475,
"country": "US",
"dst_port": 3256,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 48,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25
},
"risk_score": 31,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "c00be34285d9504e268279c3c74ba51a7e49bd16",
"event_fingerprint": "ca78b85e9276eeb56168368b80eb32041884b0ab",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 31
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
},
"target_context": {
"dst_port": 3256,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 31
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de69cb6a772475c2550cb264e33b2734be5c7a3c",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 3256,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3256 \u00b7 (sonde \/ probe)",
"target_port_label": "3256 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 31\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 48,
"novelty": 25,
"risk_score": 31
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 31,
"risk_label": "Faible",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3256,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 3256,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3256 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "3256 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3256"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
|
|
|
TCP |
4022 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:4022 · (tentative d'exploit)
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4022
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 4022,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "602456c097f8f08348dfaf1fc078650eac29ddbc",
"event_fingerprint": "3f4362c65f5c3698037a0c302cc968257e7f7139",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 4022,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c43510775e253bc741beb8e631aec543989d40d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 4022,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:4022 \u00b7 (tentative d'exploit)",
"target_port_label": "4022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4022,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 4022,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:4022 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "4022 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
4022 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:4022 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4022
Chemin / cible
—
Service
TLS
Payload
� ������Ļ �XG 7�Ғ"+ �O���I6 M ���m��σ� � 9����qhcI�좞$�� �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ������Ļ �XG 7�Ғ"+ �O���I6 M ���m��σ� � 9����qhcI�좞$�� �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� ������Ļ �XG 7�Ғ"+ �O���I6 M ���m��σ� � 9����qhcI�좞$�� �+�/�,�0̨̩� �� � c � ��� 2 + 3����y�w=LO|ۚ�2j�0���,�,
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.730841466934329,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 4022,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "dcb9a1099cd0f255ccc7d2db537d45feef186530",
"event_fingerprint": "1794520e61c26adbb7013c2bb3e6226bb9b40c1e",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "91d1cf15bfdafc6bb8b6a76ac3fffa54",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4022,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u013b\f\ufffdXG\u0004\f7\ufffd\u0492\"+\u0000\ufffdO\ufffd\u000f\ufffd\ufffd\u0013I6\u001e\u0018M \ufffd\ufffd\u0012\ufffdm\ufffd\ufffd\u0002\u03c3\ufffd\u0000\ufffd\u00009\ufffd\ufffd\ufffd\ufffdqhcI\ufffd\uc89e$\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u013b\f\ufffdXG\u0004\f7\ufffd\u0492\"+\u0000\ufffdO\ufffd\u000f\ufffd\ufffd\u0013I6\u001e\u0018M \ufffd\ufffd\u0012\ufffdm\ufffd\ufffd\u0002\u03c3\ufffd\u0000\ufffd\u00009\ufffd\ufffd\ufffd\ufffdqhcI\ufffd\uc89e$\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdy\ufffdw=LO|\u06da\ufffd2\u0012j\ufffd0\ufffd\ufffd\ufffd,\ufffd,",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u013b\f\ufffdXG\u0004\f7\ufffd\u0492\"+\u0000\ufffdO\ufffd\u000f\ufffd\ufffd\u0013I6\u001e\u0018M \ufffd\ufffd\u0012\ufffdm\ufffd\ufffd\u0002\u03c3\ufffd\u0000\ufffd\u00009\ufffd\ufffd\ufffd\ufffdqhcI\ufffd\uc89e$\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "edbcc8509a8a8a13119a62904f45c980c792a655",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u013b\f\ufffdXG\u0004\f7\ufffd\u0492\"+\u0000\ufffdO\ufffd\u000f\ufffd\ufffd\u0013I6\u001e\u0018M \ufffd\ufffd\u0012\ufffdm\ufffd\ufffd\u0002\u03c3\ufffd\u0000\ufffd\u00009\ufffd\ufffd\ufffd\ufffdqhcI\ufffd\uc89e$\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 4022,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u013b\ufffdXG7\ufffd\u0492\"+\ufffdO\ufffd\ufffd\ufffdI6M \ufffd\ufffd\ufffdm\ufffd\ufffd\u03c3\ufffd\ufffd9\ufffd\ufffd\ufffd\ufffdqhcI\ufffd\uc89e$\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:4022 \u00b7 (sonde \/ probe)",
"target_port_label": "4022 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4022,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\u013b\f\ufffdXG\u0004\f7\ufffd\u0492\"+\u0000\ufffdO\ufffd\u000f\ufffd\ufffd\u0013I6\u001e\u0018M \ufffd\ufffd\u0012\ufffdm\ufffd\ufffd\u0002\u03c3\ufffd\u0000\ufffd\u00009\ufffd\ufffd\ufffd\ufffdqhcI\ufffd\uc89e$\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 4022,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:4022 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u013b\ufffdXG7\ufffd\u0492\"+\ufffdO\ufffd\ufffd\ufffdI6M \ufffd\ufffd\ufffdm\ufffd\ufffd\u03c3\ufffd\ufffd9\ufffd\ufffd\ufffd\ufffdqhcI\ufffd\uc89e$\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "4022 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4022"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
4200 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:4200 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
4200
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 4200,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "8e66fdb0f3a11277552052440031c2e847c08d30",
"event_fingerprint": "151f1bed2dca520bcc7444130880b5cc908698f9",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 4200,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa65183b08a8cc92dd7b716393a7e754b423c2ff",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 4200,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:4200 \u00b7 (tentative d'exploit)",
"target_port_label": "4200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4200,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 4200,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:4200 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "4200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
4200 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:4200 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4200
Chemin / cible
—
Service
TLS
Payload
� �ZY$`M��2��8p���e���!Ü t 4 �f�� �m���N��H�P{=N��) �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ZY$`M��2��8p���e���!Ü t 4 �f�� �m���N��H�P{=N��) �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� �ZY$`M��2��8p���e���!Ü t 4 �f�� �m���N��H�P{=N��) �+�/�,�0̨̩� �� � c � ��� 2 + 3������.I zy9FṜx�[�U��
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.713599473194886,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 4200,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "17685052135433fa0577ccf610891e5eaf5a4b4b",
"event_fingerprint": "62f5dc918e7a59f79291d166349daad8737ee77b",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "e3ad70bd3d0d4cb7487c0eaba5431446",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 4200,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\u0005Y$`M\ufffd\ufffd2\ufffd\u000e\ufffd8p\ufffd\ufffd\ufffd\ufbcee\ufffd\ufffd\u0015\u0004\ufffd!\u00dc\u0011 t\u00004\u001f\u0017\ufffdf\ufffd\ufffd\u0006\u001d\u0381\ufffdm\ufffd\ufffd\ufffdN\u0014\ufffd\ufffdH\ufffdP{=N\ufffd\ufffd)\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\u0005Y$`M\ufffd\ufffd2\ufffd\u000e\ufffd8p\ufffd\ufffd\ufffd\ufbcee\ufffd\ufffd\u0015\u0004\ufffd!\u00dc\u0011 t\u00004\u001f\u0017\ufffdf\ufffd\ufffd\u0006\u001d\u0381\ufffdm\ufffd\ufffd\ufffdN\u0014\ufffd\ufffdH\ufffdP{=N\ufffd\ufffd)\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd.I\u000bzy9F\u1e5cx\ufffd[\ufffdU\u001a\ufffd\ufffd\u0015",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\u0005Y$`M\ufffd\ufffd2\ufffd\u000e\ufffd8p\ufffd\ufffd\ufffd\ufbcee\ufffd\ufffd\u0015\u0004\ufffd!\u00dc\u0011 t\u00004\u001f\u0017\ufffdf\ufffd\ufffd\u0006\u001d\u0381\ufffdm\ufffd\ufffd\ufffdN\u0014\ufffd\ufffdH\ufffdP{=N\ufffd\ufffd)\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d2d0d651c91f6ef5666ee01920b9130f203dfc54",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\u0005Y$`M\ufffd\ufffd2\ufffd\u000e\ufffd8p\ufffd\ufffd\ufffd\ufbcee\ufffd\ufffd\u0015\u0004\ufffd!\u00dc\u0011 t\u00004\u001f\u0017\ufffdf\ufffd\ufffd\u0006\u001d\u0381\ufffdm\ufffd\ufffd\ufffdN\u0014\ufffd\ufffdH\ufffdP{=N\ufffd\ufffd)\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 4200,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdZY$`M\ufffd\ufffd2\ufffd\ufffd8p\ufffd\ufffd\ufffd\ufbcee\ufffd\ufffd\ufffd!\u00dc t4\ufffdf\ufffd\ufffd\u0381\ufffdm\ufffd\ufffd\ufffdN\ufffd\ufffdH\ufffdP{=N\ufffd\ufffd)\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:4200 \u00b7 (sonde \/ probe)",
"target_port_label": "4200 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4200,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\u0005Y$`M\ufffd\ufffd2\ufffd\u000e\ufffd8p\ufffd\ufffd\ufffd\ufbcee\ufffd\ufffd\u0015\u0004\ufffd!\u00dc\u0011 t\u00004\u001f\u0017\ufffdf\ufffd\ufffd\u0006\u001d\u0381\ufffdm\ufffd\ufffd\ufffdN\u0014\ufffd\ufffdH\ufffdP{=N\ufffd\ufffd)\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 4200,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:4200 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdZY$`M\ufffd\ufffd2\ufffd\ufffd8p\ufffd\ufffd\ufffd\ufbcee\ufffd\ufffd\ufffd!\u00dc t4\ufffdf\ufffd\ufffd\u0381\ufffdm\ufffd\ufffd\ufffdN\ufffd\ufffdH\ufffdP{=N\ufffd\ufffd)\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "4200 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
7564 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:7564 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
7564
Chemin / cible
—
Service
TLS
Payload
� ����ד�pu@JHe�A�����v$'b�Y�;k< �#NZo�����ࡍ%�y&�ڃb����� �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����ד�pu@JHe�A�����v$'b�Y�;k<
�#NZo�����ࡍ%�y&�ڃb����� �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� ����ד�pu@JHe�A�����v$'b�Y�;k< �#NZo�����ࡍ%�y&�ڃb����� �+�/�,�0̨̩� �� � c � ��� 2 + 3�������"�5�e g�^���Xgw�
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.751506739980174,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 7564,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "69e4b7bb1fc04c7d76d3e135481568b722cf352d",
"event_fingerprint": "b277b39cfac0e03d6112d0d374deba47df9a6deb",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "bffb6a91d2f57a8366003febd38ac9c1",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 7564,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u05d3\ufffdpu@JHe\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffdv$'b\ufffdY\ufffd;k<\n \ufffd#NZo\ufffd\ufffd\ufffd\ufffd\ufffd\u084d%\u0012\ufffd\u001by&\u0018\ufffd\u0683b\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u05d3\ufffdpu@JHe\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffdv$'b\ufffdY\ufffd;k<\n \ufffd#NZo\ufffd\ufffd\ufffd\ufffd\ufffd\u084d%\u0012\ufffd\u001by&\u0018\ufffd\u0683b\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\"\ufffd5\ufffde g\ufffd\u0016^\ufffd\u000e\ufffd\ufffdXgw\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u05d3\ufffdpu@JHe\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffdv$'b\ufffdY\ufffd;k<\n \ufffd#NZo\ufffd\ufffd\ufffd\ufffd\ufffd\u084d%\u0012\ufffd\u001by&\u0018\ufffd\u0683b\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e50c79cb6fdbda0e196efdd3036457b13e71c8c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u05d3\ufffdpu@JHe\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffdv$'b\ufffdY\ufffd;k<\n \ufffd#NZo\ufffd\ufffd\ufffd\ufffd\ufffd\u084d%\u0012\ufffd\u001by&\u0018\ufffd\u0683b\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 7564,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u05d3\ufffdpu@JHe\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffdv$'b\ufffdY\ufffd;k<\n \ufffd#NZo\ufffd\ufffd\ufffd\ufffd\ufffd\u084d%\ufffdy&\ufffd\u0683b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:7564 \u00b7 (sonde \/ probe)",
"target_port_label": "7564 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 7564,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u05d3\ufffdpu@JHe\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffdv$'b\ufffdY\ufffd;k<\n \ufffd#NZo\ufffd\ufffd\ufffd\ufffd\ufffd\u084d%\u0012\ufffd\u001by&\u0018\ufffd\u0683b\ufffd\ufffd\ufffd\ufffd\u0016\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 7564,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:7564 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\u05d3\ufffdpu@JHe\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffdv$'b\ufffdY\ufffd;k<\n \ufffd#NZo\ufffd\ufffd\ufffd\ufffd\ufffd\u084d%\ufffdy&\ufffd\u0683b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "7564 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "7564"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
7564 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:7564 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
7564
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 54
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 7564,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6f01412273471c4e158b47d85480141458b8bc33",
"event_fingerprint": "7c93a7c17483ddbcb2bc578b1a7b6eeeb2df459d",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 7564,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e02c4d99ddf0d8190abdea943e48b01957db1daa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 7564,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:7564 \u00b7 (tentative d'exploit)",
"target_port_label": "7564 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7564,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 7564,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:7564 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "7564 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7564"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
12 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:12 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
12
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 56
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 12,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 56,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "11e96245e68a6e07eb549d10934878a9c428e528",
"event_fingerprint": "9830eb95728ec576c6df2c9bbfc0edda8743d448",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 12,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e2f320f8bd8326ec786a08a1cb7b866dc1d3a5b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 12,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:12 \u00b7 (tentative d'exploit)",
"target_port_label": "12 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 12,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 12,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:12 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "12 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "12"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
12 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:12 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12
Chemin / cible
—
Service
TLS
Payload
� �� 6s��i%fMX���=� f�� =њa�1_�Hn �������e��l>ڣH� �� ����J��m� �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��
6s��i%fMX���=�
f�� =њa�1_�Hn �������e��l>ڣH� �� ����J��m� �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� �� 6s��i%fMX���=� f�� =њa�1_�Hn �������e��l>ڣH� �� ����J��m� �+�/�,�0̨̩� �� � c � ��� 2 + 3�����`��^K+�Q�g���k��j
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.7402834575859645,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 12,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "971d73d6d0f7d51c949f0712984f339d8287500e",
"event_fingerprint": "93e6573b3d73794fd3dfe031fd22479bcd01aa2e",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "063949bcaaebd2ef980ff6054cdd90f5",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 12,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\r6s\ufffd\ufffdi%fMX\ufffd\ufffd\ufffd=\ufffd\nf\ufffd\ufffd\u001d=\u045aa\ufffd1_\ufffdHn\u001b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0013\ufffd\ufffdl>\u06a3H\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdm\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\r6s\ufffd\ufffdi%fMX\ufffd\ufffd\ufffd=\ufffd\nf\ufffd\ufffd\u001d=\u045aa\ufffd1_\ufffdHn\u001b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0013\ufffd\ufffdl>\u06a3H\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdm\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd`\ufffd\u0017\ufffd^K\u0018+\ufffdQ\ufffdg\ufffd\ufffd\ufffdk\u000e\ufffd\ufffdj",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\r6s\ufffd\ufffdi%fMX\ufffd\ufffd\ufffd=\ufffd\nf\ufffd\ufffd\u001d=\u045aa\ufffd1_\ufffdHn\u001b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0013\ufffd\ufffdl>\u06a3H\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdm\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "115fe7918f2a775b3f9780d0debc74ca9b92d0e0",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\r6s\ufffd\ufffdi%fMX\ufffd\ufffd\ufffd=\ufffd\nf\ufffd\ufffd\u001d=\u045aa\ufffd1_\ufffdHn\u001b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0013\ufffd\ufffdl>\u06a3H\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdm\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 12,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\r6s\ufffd\ufffdi%fMX\ufffd\ufffd\ufffd=\ufffd\nf\ufffd\ufffd=\u045aa\ufffd1_\ufffdHn \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\ufffdl>\u06a3H\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdm\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:12 \u00b7 (sonde \/ probe)",
"target_port_label": "12 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 12,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\r6s\ufffd\ufffdi%fMX\ufffd\ufffd\ufffd=\ufffd\nf\ufffd\ufffd\u001d=\u045aa\ufffd1_\ufffdHn\u001b \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\u0013\ufffd\ufffdl>\u06a3H\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdm\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 12,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:12 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\r6s\ufffd\ufffdi%fMX\ufffd\ufffd\ufffd=\ufffd\nf\ufffd\ufffd=\u045aa\ufffd1_\ufffdHn \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffde\ufffd\ufffdl>\u06a3H\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffdm\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "12 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "12"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
6080 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:6080 · (tentative d'exploit)
|
Élevée
|
Moyen · 55
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
6080
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 55
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 6080,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "18243ced1592fee7021590121b394031741adf14",
"event_fingerprint": "847567897d16f31433389a0dbb498c475c176129",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 6080,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "752453581c0818bdda3d2a9925edf82e1d148783",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 6080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:6080 \u00b7 (tentative d'exploit)",
"target_port_label": "6080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 55
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6080,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 6080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:6080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "6080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|
|
|
TCP |
6080 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:6080 · (sonde / probe)
|
Moyenne
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 725543c78edf6691
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
6080
Chemin / cible
—
Service
TLS
Payload
� �0 >�T��мI�r���$���%]���m�� 5F;=�m�>�� �Hz� �~RN�Q���a�� �+�/�,�0̨̩� �� � c �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �0 >�T��мI�r���$���%]���m�� 5F;=�m�>�� �Hz� �~RN�Q���a�� �+�/�,�0̨̩� ��
� c �
Requête brute (extrait)
� �0 >�T��мI�r���$���%]���m�� 5F;=�m�>�� �Hz� �~RN�Q���a�� �+�/�,�0̨̩� �� � c � ��� 2 + 3���� w�ۈ�D��L���9�obX
Meta JSON brut
{
"tls_ja3_hash": "725543c78edf669194c11dc7a039b56e",
"tls_sni": null,
"bytes_in": 1487,
"payload_entropy": 7.7424428901996984,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "tls",
"app_proto": "tls",
"asn": 32475,
"country": "US",
"dst_port": 6080,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.3,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "afc46624ae5df9bcac5ba3e34a66b44a25dbd52c",
"event_fingerprint": "14daca6d43026b3fed52bc5bba37cffeac9a5317",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "725543c78edf669194c11dc7a039b56e",
"payload_hash": "232877d4f04b0bc159025a343af40d63",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 6080,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00030\u0000>\ufffdT\ufffd\ufffd\u043cI\ufffdr\ufffd\ufffd\b\ufffd$\ufffd\ufffd\ufffd%]\ufffd\ufffd\ufffdm\ufffd\ufffd 5F;=\ufffdm\ufffd>\ufffd\ufffd\f\ufffdHz\ufffd\u0000\ufffd~RN\uf7be\ufffdQ\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00030\u0000>\ufffdT\ufffd\ufffd\u043cI\ufffdr\ufffd\ufffd\b\ufffd$\ufffd\ufffd\ufffd%]\ufffd\ufffd\ufffdm\ufffd\ufffd 5F;=\ufffdm\ufffd>\ufffd\ufffd\f\ufffdHz\ufffd\u0000\ufffd~RN\uf7be\ufffdQ\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\tw\ufffd\u0002\u06c8\b\ufffdD\ufffd\u0001\ufffdL\ufffd\ufffd\ufffd9\ufffdobX",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00030\u0000>\ufffdT\ufffd\ufffd\u043cI\ufffdr\ufffd\ufffd\b\ufffd$\ufffd\ufffd\ufffd%]\ufffd\ufffd\ufffdm\ufffd\ufffd 5F;=\ufffdm\ufffd>\ufffd\ufffd\f\ufffdHz\ufffd\u0000\ufffd~RN\uf7be\ufffdQ\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df03022a375e875ec373430fc183c1bf879adb04",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00030\u0000>\ufffdT\ufffd\ufffd\u043cI\ufffdr\ufffd\ufffd\b\ufffd$\ufffd\ufffd\ufffd%]\ufffd\ufffd\ufffdm\ufffd\ufffd 5F;=\ufffdm\ufffd>\ufffd\ufffd\f\ufffdHz\ufffd\u0000\ufffd~RN\uf7be\ufffdQ\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 6080,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffd0>\ufffdT\ufffd\ufffd\u043cI\ufffdr\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd%]\ufffd\ufffd\ufffdm\ufffd\ufffd 5F;=\ufffdm\ufffd>\ufffd\ufffd\ufffdHz\ufffd\ufffd~RN\uf7be\ufffdQ\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:6080 \u00b7 (sonde \/ probe)",
"target_port_label": "6080 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 6080,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00030\u0000>\ufffdT\ufffd\ufffd\u043cI\ufffdr\ufffd\ufffd\b\ufffd$\ufffd\ufffd\ufffd%]\ufffd\ufffd\ufffdm\ufffd\ufffd 5F;=\ufffdm\ufffd>\ufffd\ufffd\f\ufffdHz\ufffd\u0000\ufffd~RN\uf7be\ufffdQ\ufffd\ufffd\ufffd\u0011a\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"tls_ja3": "725543c78edf669194c11dc7a039b56e",
"port": 6080,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:6080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd0>\ufffdT\ufffd\ufffd\u043cI\ufffdr\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd%]\ufffd\ufffd\ufffdm\ufffd\ufffd 5F;=\ufffdm\ufffd>\ufffd\ufffd\ufffdHz\ufffd\ufffd~RN\uf7be\ufffdQ\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
"target_port_label": "6080 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "6080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni"
]
}
|
|
|
TCP |
17 · QOTD
|
qotd
|
Botnet Mozi
mozi pattern · via QOTD:17 · (commande & contrôle)
|
Élevée
|
Faible · 37
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
QOTD
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
17
Chemin / cible
—
Service
QOTD
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 37
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420716f746420726561647920706f72743d31370d0a",
"emulator_response_len": 33,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "qotd",
"app_proto": "qotd",
"asn": 32475,
"country": "US",
"dst_port": 17,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 37,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d0fffda8c6bf77aeac000dec295aa0b1c4787c74",
"event_fingerprint": "ee0e4fcd512cb1a427a5678bf6b7afe9b44d208c",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 37
},
"named_classification_skipped": false,
"service_name": "qotd",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 17,
"service": "qotd",
"service_name": "qotd",
"risk_score": 37
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f66141041d3a2646db62694225b822173e7c701b",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 17,
"service": "qotd",
"service_label_fr": "QOTD"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "mozi pattern \u00b7 via QOTD:17 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "17 \u00b7 QOTD",
"emulator_service": "qotd",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0011 \u2014 via QOTD",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 37
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "qotd",
"service_label_fr": "QOTD",
"dst_port": 17,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-qotd",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 17,
"service": "qotd",
"service_label_fr": "QOTD"
},
"attack_vector": "mozi pattern \u00b7 via QOTD:17 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "17 \u00b7 QOTD",
"emulator_service": "qotd",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "qotd",
"service_banner": "honeypot-qotd",
"service_os": "linux",
"dst_port": "17"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
12345 · NETBUS
|
netbus
|
Botnet Mozi
mozi pattern · via NETBUS:12345 · (commande & contrôle)
|
Élevée
|
Faible · 36
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
NETBUS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
12345
Chemin / cible
—
Service
NETBUS
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a",
"emulator_response_len": 38,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "netbus",
"app_proto": "netbus",
"asn": 32475,
"country": "US",
"dst_port": 12345,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 36,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2a8591f17a74cbf579eca5d57133d975e28026dd",
"event_fingerprint": "4e74698fe2fcb538405d3ea87b5725c2dd122d5d",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "netbus",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 12345,
"service": "netbus",
"service_name": "netbus",
"risk_score": 36
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3fcaf11447fba284e365f0906ef1f0e2b23a21ce",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "mozi pattern \u00b7 via NETBUS:12345 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via NETBUS",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "netbus",
"service_label_fr": "NETBUS",
"dst_port": 12345,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-netbus",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"attack_vector": "mozi pattern \u00b7 via NETBUS:12345 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "netbus",
"service_banner": "honeypot-netbus",
"service_os": "linux",
"dst_port": "12345"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
5555 · PERSONAL AGENT
|
personal-agent
|
Botnet Mozi
mozi pattern · via PERSONAL AGENT:5555 · (commande & contrôle)
|
Élevée
|
Faible · 36
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
PERSONAL-AGENT
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5555
Chemin / cible
—
Service
PERSONAL AGENT
Payload
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
Motifs de détection (base)
LFI Double-dot bypass
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f7420706572736f6e616c5f6167656e7420726561647920706f72743d353535350d0a",
"emulator_response_len": 45,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "registered",
"org": "Internap Holding LLC",
"service": "personal-agent",
"app_proto": "personal-agent",
"asn": 32475,
"country": "US",
"dst_port": 5555,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 36,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ca86f7325a99633c0a407616c60b49d56f6a905c",
"event_fingerprint": "fbc7cd65c63777f6c38709cfcc0b6e7651d2fdc4",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "personal-agent",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 5555,
"service": "personal-agent",
"service_name": "personal-agent",
"risk_score": 36
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b875945505ce0628ccda5c4030e837d05844591",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 5555,
"service": "personal-agent",
"service_label_fr": "PERSONAL AGENT"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "mozi pattern \u00b7 via PERSONAL AGENT:5555 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "5555 \u00b7 PERSONAL AGENT",
"emulator_service": "personal-agent",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via PERSONAL AGENT",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "personal-agent",
"service_label_fr": "PERSONAL AGENT",
"dst_port": 5555,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-personal-agent",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"port": 5555,
"service": "personal-agent",
"service_label_fr": "PERSONAL AGENT"
},
"attack_vector": "mozi pattern \u00b7 via PERSONAL AGENT:5555 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "5555 \u00b7 PERSONAL AGENT",
"emulator_service": "personal-agent",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "personal_agent",
"service_banner": "honeypot-personal-agent",
"service_os": "linux",
"dst_port": "5555"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
15 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:15 · (tentative d'exploit)
|
Élevée
|
Moyen · 57
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-lab…
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
15
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 User-Agent: Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info) Accept: */* Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2cce74947ae104861c6404693b60cc04c0330b1d",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 165,
"payload_entropy": 5.222494310506847,
"port_category": "well_known",
"org": "Internap Holding LLC",
"service": "http",
"app_proto": "http",
"asn": 32475,
"country": "US",
"dst_port": 15,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f9c17f16cd0fe2acddab222cd71464d832734060",
"event_fingerprint": "f4597112ba6e28d9c08063b5eec73a7213670254",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 32475,
"org": "Internap Holding LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "83dce64baa2f0543cbc5015d0224fa45",
"payload_hash": "25e1dbb9dc3e9dd092f07b00f8ffcace",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 15,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "926ff7b3a234c68b364fbece02f1fa6de0db8bb8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 15,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"attack_vector": "ssrf attack \u00b7 via HTTP:15 \u00b7 (tentative d'exploit)",
"target_port_label": "15 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 57
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 15,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info)",
"port": 15,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:15 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: Mozilla\/5.0 (compatible; FlowIQLabsBot\/1.0; +https:\/\/flowiq-labs.com\/scanning-info",
"target_port_label": "15 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "15"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
|