|
|
TCP |
8086 · INFLUXDB
|
influxdb
|
Sonde PostgreSQL
postgres probe · via INFLUXDB:8086 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
INFLUXDB
WAF
—
Recommandation
Surveiller
Tags
influxdb_emulated
influxdb_payload
net_influxdb_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8086
Chemin / cible
—
Service
INFLUXDB
Payload
X�p�p�����>DѱCv�X�|�)�*8`� �a|�V��y�H �%V���� �G����� &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
X�p�p�����>DѱCv�X�|�)�*8`� �a|�V��y�H �%V����
�G����� &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
X�p�p�����>DѱCv�X�|�)�*8`� �a|�V��y�H �%V���� �G����� &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ ��5��+ r`���&
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a582d496e666c757864622d56657273696f6e3a20322e372e340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b226e616d65223a22686f6e6579706f742d696e666c7578222c226d6573",
"emulator_response_len": 165,
"bytes_in": 273,
"payload_entropy": 5.672066893111333,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "influxdb",
"app_proto": "influxdb",
"asn": 14061,
"country": "DE",
"dst_port": 8086,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "616d33e8b5edab9d02f533b6029e3545f5563b64",
"event_fingerprint": "a36e838654a329836d00a8ed03fe3d1cba6e1fed",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "influxdb",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ad8251b0f9ac64f3f25d797ae516931",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8086,
"service": "influxdb",
"service_name": "influxdb",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0018X\ufffdp\u0011\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd>D\u0471Cv\ufffdX\ufffd|\ufffd)\ufffd*8`\ufffd\u001a \ufffd\u0011a|\ufffdV\ufffd\ufffd\u000fy\ufffdH\u001e\ufffd%V\ufffd\ufffd\ufffd\ufffd\r\ufffdG\ufffd\ufffd\ufffd\ufffd\u000e\ufffd\u000f\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0018X\ufffdp\u0011\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd>D\u0471Cv\ufffdX\ufffd|\ufffd)\ufffd*8`\ufffd\u001a \ufffd\u0011a|\ufffdV\ufffd\ufffd\u000fy\ufffdH\u001e\ufffd%V\ufffd\ufffd\ufffd\ufffd\r\ufffdG\ufffd\ufffd\ufffd\ufffd\u000e\ufffd\u000f\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd5\ufffd\ufffd+\nr`\ufffd\ufffd\u001a\ufffd&",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0018X\ufffdp\u0011\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd>D\u0471Cv\ufffdX\ufffd|\ufffd)\ufffd*8`\ufffd\u001a \ufffd\u0011a|\ufffdV\ufffd\ufffd\u000fy\ufffdH\u001e\ufffd%V\ufffd\ufffd\ufffd\ufffd\r\ufffdG\ufffd\ufffd\ufffd\ufffd\u000e\ufffd\u000f\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "265fa81db91553a2b08902cd08693ee9f531609d",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0018X\ufffdp\u0011\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd>D\u0471Cv\ufffdX\ufffd|\ufffd)\ufffd*8`\ufffd\u001a \ufffd\u0011a|\ufffdV\ufffd\ufffd\u000fy\ufffdH\u001e\ufffd%V\ufffd\ufffd\ufffd\ufffd\r\ufffdG\ufffd\ufffd\ufffd\ufffd\u000e\ufffd\u000f\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 8086,
"service": "influxdb",
"service_label_fr": "INFLUXDB"
},
"evidence_snippet": "X\ufffdp\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd>D\u0471Cv\ufffdX\ufffd|\ufffd)\ufffd*8`\ufffd \ufffda|\ufffdV\ufffd\ufffdy\ufffdH\ufffd%V\ufffd\ufffd\ufffd\ufffd\r\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via INFLUXDB:8086 \u00b7 (sonde \/ probe)",
"target_port_label": "8086 \u00b7 INFLUXDB",
"emulator_service": "influxdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "influxdb",
"service_label_fr": "INFLUXDB",
"dst_port": 8086,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-influxdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\u0018X\ufffdp\u0011\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd>D\u0471Cv\ufffdX\ufffd|\ufffd)\ufffd*8`\ufffd\u001a \ufffd\u0011a|\ufffdV\ufffd\ufffd\u000fy\ufffdH\u001e\ufffd%V\ufffd\ufffd\ufffd\ufffd\r\ufffdG\ufffd\ufffd\ufffd\ufffd\u000e\ufffd\u000f\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 8086,
"service": "influxdb",
"service_label_fr": "INFLUXDB"
},
"attack_vector": "postgres probe \u00b7 via INFLUXDB:8086 \u00b7 (sonde \/ probe)",
"evidence_snippet": "X\ufffdp\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd>D\u0471Cv\ufffdX\ufffd|\ufffd)\ufffd*8`\ufffd \ufffda|\ufffdV\ufffd\ufffdy\ufffdH\ufffd%V\ufffd\ufffd\ufffd\ufffd\r\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "8086 \u00b7 INFLUXDB",
"emulator_service": "influxdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "influxdb",
"service_banner": "honeypot-influxdb",
"service_os": "linux",
"dst_port": "8086"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"influxdb_emulated",
"influxdb_payload",
"net_influxdb_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8086 · INFLUXDB
|
influxdb
|
Sonde PostgreSQL
postgres probe · via INFLUXDB:8086 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
INFLUXDB
WAF
—
Recommandation
Surveiller
Tags
influxdb_emulated
influxdb_payload
net_influxdb_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8086
Chemin / cible
—
Service
INFLUXDB
Payload
��)>�~D13�����` @�b��D���B�6� @S~��w���>��cU���A�^� Ҝ�5;0 &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
��)>�~D13�����`
@�b��D���B�6� @S~��w���>��cU���A�^� Ҝ�5;0 &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
��)>�~D13�����` @�b��D���B�6� @S~��w���>��cU���A�^� Ҝ�5;0 &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ �d����]�K�����
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a582d496e666c757864622d56657273696f6e3a20322e372e340d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b226e616d65223a22686f6e6579706f742d696e666c7578222c226d6573",
"emulator_response_len": 165,
"bytes_in": 273,
"payload_entropy": 5.693034489200155,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "influxdb",
"app_proto": "influxdb",
"asn": 14061,
"country": "DE",
"dst_port": 8086,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "616d33e8b5edab9d02f533b6029e3545f5563b64",
"event_fingerprint": "a36e838654a329836d00a8ed03fe3d1cba6e1fed",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "influxdb",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "295f1172471c19bf9441f96b602d53b3",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 8086,
"service": "influxdb",
"service_name": "influxdb",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd)>\ufffd~D13\ufffd\ufffd\ufffd\u0004\ufffd\ufffd`\n\u001a@\ufffdb\ufffd\ufffdD\ufffd\ufffd\ufffdB\ufffd6\u0007\ufffd @S~\ufffd\ufffdw\ufffd\ufffd\u0003\ufffd\u0002>\ufffd\u0017\ufffdcU\ufffd\ufffd\ufffdA\ufffd^\ufffd\u001f\u049c\ufffd5\u0015;0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd)>\ufffd~D13\ufffd\ufffd\ufffd\u0004\ufffd\ufffd`\n\u001a@\ufffdb\ufffd\ufffdD\ufffd\ufffd\ufffdB\ufffd6\u0007\ufffd @S~\ufffd\ufffdw\ufffd\ufffd\u0003\ufffd\u0002>\ufffd\u0017\ufffdcU\ufffd\ufffd\ufffdA\ufffd^\ufffd\u001f\u049c\ufffd5\u0015;0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0013\ufffdd\ufffd\ufffd\ufffd\ufffd]\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd)>\ufffd~D13\ufffd\ufffd\ufffd\u0004\ufffd\ufffd`\n\u001a@\ufffdb\ufffd\ufffdD\ufffd\ufffd\ufffdB\ufffd6\u0007\ufffd @S~\ufffd\ufffdw\ufffd\ufffd\u0003\ufffd\u0002>\ufffd\u0017\ufffdcU\ufffd\ufffd\ufffdA\ufffd^\ufffd\u001f\u049c\ufffd5\u0015;0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa169a53918c6e8594ee33528f260d0ef2069c09",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd)>\ufffd~D13\ufffd\ufffd\ufffd\u0004\ufffd\ufffd`\n\u001a@\ufffdb\ufffd\ufffdD\ufffd\ufffd\ufffdB\ufffd6\u0007\ufffd @S~\ufffd\ufffdw\ufffd\ufffd\u0003\ufffd\u0002>\ufffd\u0017\ufffdcU\ufffd\ufffd\ufffdA\ufffd^\ufffd\u001f\u049c\ufffd5\u0015;0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 8086,
"service": "influxdb",
"service_label_fr": "INFLUXDB"
},
"evidence_snippet": "\ufffd\ufffd)>\ufffd~D13\ufffd\ufffd\ufffd\ufffd\ufffd`\n@\ufffdb\ufffd\ufffdD\ufffd\ufffd\ufffdB\ufffd6\ufffd @S~\ufffd\ufffdw\ufffd\ufffd\ufffd>\ufffd\ufffdcU\ufffd\ufffd\ufffdA\ufffd^\ufffd\u049c\ufffd5;0&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via INFLUXDB:8086 \u00b7 (sonde \/ probe)",
"target_port_label": "8086 \u00b7 INFLUXDB",
"emulator_service": "influxdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "influxdb",
"service_label_fr": "INFLUXDB",
"dst_port": 8086,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-influxdb",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003\ufffd\ufffd)>\ufffd~D13\ufffd\ufffd\ufffd\u0004\ufffd\ufffd`\n\u001a@\ufffdb\ufffd\ufffdD\ufffd\ufffd\ufffdB\ufffd6\u0007\ufffd @S~\ufffd\ufffdw\ufffd\ufffd\u0003\ufffd\u0002>\ufffd\u0017\ufffdcU\ufffd\ufffd\ufffdA\ufffd^\ufffd\u001f\u049c\ufffd5\u0015;0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 8086,
"service": "influxdb",
"service_label_fr": "INFLUXDB"
},
"attack_vector": "postgres probe \u00b7 via INFLUXDB:8086 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd)>\ufffd~D13\ufffd\ufffd\ufffd\ufffd\ufffd`\n@\ufffdb\ufffd\ufffdD\ufffd\ufffd\ufffdB\ufffd6\ufffd @S~\ufffd\ufffdw\ufffd\ufffd\ufffd>\ufffd\ufffdcU\ufffd\ufffd\ufffdA\ufffd^\ufffd\u049c\ufffd5;0&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "8086 \u00b7 INFLUXDB",
"emulator_service": "influxdb",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "influxdb",
"service_banner": "honeypot-influxdb",
"service_os": "linux",
"dst_port": "8086"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"influxdb_emulated",
"influxdb_payload",
"net_influxdb_probe",
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2525 · SMTP ALT
|
smtp-alt
|
smtp-alt
smtp-alt · via SMTP ALT:2525 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SMTP-ALT
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2525
Chemin / cible
—
Pourquoi cette classification : Type « smtp-alt » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "323230206d61696c2e6578616d706c652e636f6d2045534d545020506f737466697820285562756e7475290d0a",
"emulator_response_len": 45,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "smtp-alt",
"app_proto": "smtp-alt",
"asn": 14061,
"country": "DE",
"dst_port": 2525,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "9eec8fda18aa8273af1f0dd2b176ba2d8dd49b9f",
"event_fingerprint": "176263d1e483c4d8cd4417a421be5cee6a39c2e5",
"classification_reason": "Type \u00ab smtp-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "smtp-alt",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "27eb47eeaffbb18e3771abd78e93c70e"
},
"target_context": {
"dst_port": 2525,
"service": "smtp-alt",
"service_name": "smtp-alt",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "803617d9d4ed84842b736b1f36613c73515dc96b",
"protocol_details": {
"smtp_auth_fr": "Sonde protocole SMTP",
"port": 2525,
"service": "smtp-alt",
"service_label_fr": "SMTP ALT"
},
"attack_vector": "smtp-alt \u00b7 via SMTP ALT:2525 \u00b7 (sonde \/ probe)",
"target_port_label": "2525 \u00b7 SMTP ALT",
"emulator_service": "smtp-alt",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab smtp-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab smtp-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "smtp-alt",
"service_label_fr": "SMTP ALT",
"dst_port": 2525,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-smtp-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"smtp_auth_fr": "Sonde protocole SMTP",
"port": 2525,
"service": "smtp-alt",
"service_label_fr": "SMTP ALT"
},
"attack_vector": "smtp-alt \u00b7 via SMTP ALT:2525 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "2525 \u00b7 SMTP ALT",
"emulator_service": "smtp-alt",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "smtp_alt",
"service_banner": "honeypot-smtp-alt",
"service_os": "linux",
"dst_port": "2525"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
4891 · TLS
|
tls
|
Sonde TLS
tls probe · via TLS:4891 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 c216e752cae6f875
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4891
Chemin / cible
—
Service
TLS
Payload
$ v�UQb~����}�cxi�^ ��� �� B �4���l�t��x:B� -���qx�n��z��s >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
$ v�UQb~����}�cxi�^ ��� �� B �4���l�t��x:B� -���qx�n��z��s >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
$ v�UQb~����}�cxi�^ ��� �� B �4���l�t��x:B� -���qx�n��z��s >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � � # * ( + -
Meta JSON brut
{
"tls_ja3_hash": "c216e752cae6f8755fd27f561d031636",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 297,
"payload_entropy": 5.761898598221434,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 14061,
"country": "DE",
"dst_port": 4891,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7c4901938777a7c142be807a8ae2551bd17e5a29",
"event_fingerprint": "c588d6bb769d531ae6dfc67b35e1febf22f966df",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"service_name": "tls",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c216e752cae6f8755fd27f561d031636",
"payload_hash": "649356ad007b0ab7c591aa261167f338",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 4891,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003v\ufffd\u0017UQb\u0015~\ufffd\ufffd\ufffd\u0016\ufffd}\ufffdcxi\u0016\ufffd^\u0000\ufffd\ufffd\u001b\ufffd\f\u001a\ufffd\ufffd\tB \ufffd4\ufffd\ufffd\ufffdl\ufffdt\ufffd\ufffd\u0001x:B\ufffd\u0017\u001f-\ufffd\ufffd\ufffdqx\ufffdn\ufffd\u0006\ufffdz\ufffd\ufffds\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003v\ufffd\u0017UQb\u0015~\ufffd\ufffd\ufffd\u0016\ufffd}\ufffdcxi\u0016\ufffd^\u0000\ufffd\ufffd\u001b\ufffd\f\u001a\ufffd\ufffd\tB \ufffd4\ufffd\ufffd\ufffdl\ufffdt\ufffd\ufffd\u0001x:B\ufffd\u0017\u001f-\ufffd\ufffd\ufffdqx\ufffdn\ufffd\u0006\ufffdz\ufffd\ufffds\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u0000-\u0000\u0002\u0001\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003v\ufffd\u0017UQb\u0015~\ufffd\ufffd\ufffd\u0016\ufffd}\ufffdcxi\u0016\ufffd^\u0000\ufffd\ufffd\u001b\ufffd\f\u001a\ufffd\ufffd\tB \ufffd4\ufffd\ufffd\ufffdl\ufffdt\ufffd\ufffd\u0001x:B\ufffd\u0017\u001f-\ufffd\ufffd\ufffdqx\ufffdn\ufffd\u0006\ufffdz\ufffd\ufffds\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "17980ceabf7ebdf1c00158d3f8319a441e6177ca",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003v\ufffd\u0017UQb\u0015~\ufffd\ufffd\ufffd\u0016\ufffd}\ufffdcxi\u0016\ufffd^\u0000\ufffd\ufffd\u001b\ufffd\f\u001a\ufffd\ufffd\tB \ufffd4\ufffd\ufffd\ufffdl\ufffdt\ufffd\ufffd\u0001x:B\ufffd\u0017\u001f-\ufffd\ufffd\ufffdqx\ufffdn\ufffd\u0006\ufffdz\ufffd\ufffds\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c216e752cae6f8755fd27f561d031636",
"port": 4891,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "$ v\ufffdUQb~\ufffd\ufffd\ufffd\ufffd}\ufffdcxi\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\tB \ufffd4\ufffd\ufffd\ufffdl\ufffdt\ufffd\ufffdx:B\ufffd-\ufffd\ufffd\ufffdqx\ufffdn\ufffd\ufffdz\ufffd\ufffds>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"attack_vector": "tls probe \u00b7 via TLS:4891 \u00b7 (sonde \/ probe)",
"target_port_label": "4891 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 4891,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001$\u0001\u0000\u0001 \u0003\u0003v\ufffd\u0017UQb\u0015~\ufffd\ufffd\ufffd\u0016\ufffd}\ufffdcxi\u0016\ufffd^\u0000\ufffd\ufffd\u001b\ufffd\f\u001a\ufffd\ufffd\tB \ufffd4\ufffd\ufffd\ufffdl\ufffdt\ufffd\ufffd\u0001x:B\ufffd\u0017\u001f-\ufffd\ufffd\ufffdqx\ufffdn\ufffd\u0006\ufffdz\ufffd\ufffds\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"tls_ja3": "c216e752cae6f8755fd27f561d031636",
"port": 4891,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "tls probe \u00b7 via TLS:4891 \u00b7 (sonde \/ probe)",
"evidence_snippet": "$ v\ufffdUQb~\ufffd\ufffd\ufffd\ufffd}\ufffdcxi\ufffd^\ufffd\ufffd\ufffd\ufffd\ufffd\tB \ufffd4\ufffd\ufffd\ufffdl\ufffdt\ufffd\ufffdx:B\ufffd-\ufffd\ufffd\ufffdqx\ufffdn\ufffd\ufffdz\ufffd\ufffds>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd",
"target_port_label": "4891 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "4891"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
11434 · OLLAMA
|
ollama
|
Sonde PostgreSQL
postgres probe · via OLLAMA:11434 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
OLLAMA
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11434
Chemin / cible
—
Service
OLLAMA
Payload
:\ �_$,��0�A#���^7C��:���ZՊU& ��I�d�I�RB�(!�Zs��� � �s��8ʉ &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
:\ �_$,��0�A#���^7C��:���ZՊU& ��I�d�I�RB�(!�Zs��� � �s��8ʉ &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
:\ �_$,��0�A#���^7C��:���ZՊU& ��I�d�I�RB�(!�Zs��� � �s��8ʉ &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ yAO!�H��>�8z�}
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 273,
"payload_entropy": 5.772971735980452,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "ollama",
"app_proto": "ollama",
"asn": 14061,
"country": "DE",
"dst_port": 11434,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f2a17d825ce172bcf72ac0b1659a0f22375133c0",
"event_fingerprint": "e5de7378bdf0b23e311530c009ea1c8bba9f0677",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "ollama",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e275a37380b77d41bdf7bdcd5769c2d3",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 11434,
"service": "ollama",
"service_name": "ollama",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003:\\\u000b\ufffd_$,\u0005\ufffd\ufffd0\ufffdA#\ufffd\ufffd\ufffd^7C\ufffd\ufffd:\ufffd\ufffd\ufffdZ\u054aU& \ufffd\ufffdI\ufffdd\ufffdI\ufffd\u000eRB\ufffd(!\ufffdZs\ufffd\u0006\ufffd\u0001\ufffd\u001c\ufffd\u001e\ufffds\ufffd\ufffd8\u0289\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003:\\\u000b\ufffd_$,\u0005\ufffd\ufffd0\ufffdA#\ufffd\ufffd\ufffd^7C\ufffd\ufffd:\ufffd\ufffd\ufffdZ\u054aU& \ufffd\ufffdI\ufffdd\ufffdI\ufffd\u000eRB\ufffd(!\ufffdZs\ufffd\u0006\ufffd\u0001\ufffd\u001c\ufffd\u001e\ufffds\ufffd\ufffd8\u0289\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 yAO!\ufffdH\ufffd\ufffd>\ufffd8z\ufffd\u0012}",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003:\\\u000b\ufffd_$,\u0005\ufffd\ufffd0\ufffdA#\ufffd\ufffd\ufffd^7C\ufffd\ufffd:\ufffd\ufffd\ufffdZ\u054aU& \ufffd\ufffdI\ufffdd\ufffdI\ufffd\u000eRB\ufffd(!\ufffdZs\ufffd\u0006\ufffd\u0001\ufffd\u001c\ufffd\u001e\ufffds\ufffd\ufffd8\u0289\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e16ce7124660b4859f99cfbc800f0ea2d31767fd",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003:\\\u000b\ufffd_$,\u0005\ufffd\ufffd0\ufffdA#\ufffd\ufffd\ufffd^7C\ufffd\ufffd:\ufffd\ufffd\ufffdZ\u054aU& \ufffd\ufffdI\ufffdd\ufffdI\ufffd\u000eRB\ufffd(!\ufffdZs\ufffd\u0006\ufffd\u0001\ufffd\u001c\ufffd\u001e\ufffds\ufffd\ufffd8\u0289\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 11434,
"service": "ollama",
"service_label_fr": "OLLAMA"
},
"evidence_snippet": ":\\\ufffd_$,\ufffd\ufffd0\ufffdA#\ufffd\ufffd\ufffd^7C\ufffd\ufffd:\ufffd\ufffd\ufffdZ\u054aU& \ufffd\ufffdI\ufffdd\ufffdI\ufffdRB\ufffd(!\ufffdZs\ufffd\ufffd\ufffd\ufffd\ufffds\ufffd\ufffd8\u0289&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via OLLAMA:11434 \u00b7 (sonde \/ probe)",
"target_port_label": "11434 \u00b7 OLLAMA",
"emulator_service": "ollama",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "ollama",
"service_label_fr": "OLLAMA",
"dst_port": 11434,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ollama",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003:\\\u000b\ufffd_$,\u0005\ufffd\ufffd0\ufffdA#\ufffd\ufffd\ufffd^7C\ufffd\ufffd:\ufffd\ufffd\ufffdZ\u054aU& \ufffd\ufffdI\ufffdd\ufffdI\ufffd\u000eRB\ufffd(!\ufffdZs\ufffd\u0006\ufffd\u0001\ufffd\u001c\ufffd\u001e\ufffds\ufffd\ufffd8\u0289\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 11434,
"service": "ollama",
"service_label_fr": "OLLAMA"
},
"attack_vector": "postgres probe \u00b7 via OLLAMA:11434 \u00b7 (sonde \/ probe)",
"evidence_snippet": ":\\\ufffd_$,\ufffd\ufffd0\ufffdA#\ufffd\ufffd\ufffd^7C\ufffd\ufffd:\ufffd\ufffd\ufffdZ\u054aU& \ufffd\ufffdI\ufffdd\ufffdI\ufffdRB\ufffd(!\ufffdZs\ufffd\ufffd\ufffd\ufffd\ufffds\ufffd\ufffd8\u0289&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "11434 \u00b7 OLLAMA",
"emulator_service": "ollama",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ollama",
"service_banner": "honeypot-ollama",
"service_os": "linux",
"dst_port": "11434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
11434 · OLLAMA
|
ollama
|
Sonde PostgreSQL
postgres probe · via OLLAMA:11434 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
OLLAMA
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
11434
Chemin / cible
—
Service
OLLAMA
Payload
b5#xH��4�'�ქ�k ��3�m4�:+� ���:"� ߡ�;Nid.��0+�&��`��T��� &�+�/�,�0̨̩� �� � � � / 5� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
b5#xH��4�'�ქ�k ��3�m4�:+� ���:"�
ߡ�;Nid.��0+�&��`��T��� &�+�/�,�0̨̩� ��
� � � / 5�
� �
Requête brute (extrait)
b5#xH��4�'�ქ�k ��3�m4�:+� ���:"� ߡ�;Nid.��0+�&��`��T��� &�+�/�,�0̨̩� �� � � � / 5� � � 2 + 3 & $ "ka��,�Ҋ� o
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 273,
"payload_entropy": 5.634248076572877,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "ollama",
"app_proto": "ollama",
"asn": 14061,
"country": "DE",
"dst_port": 11434,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f2a17d825ce172bcf72ac0b1659a0f22375133c0",
"event_fingerprint": "e5de7378bdf0b23e311530c009ea1c8bba9f0677",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "ollama",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "66074c5b994bc3362b19eb9362a15c68",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 11434,
"service": "ollama",
"service_name": "ollama",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003b\u00075#xH\u0007\ufffd\u0014\ufffd\u00124\ufffd'\ufffd\u10e5\ufffd\u0001k\u001d\ufffd\ufffd3\ufffdm4\ufffd:+\ufffd \u0004\ufffd\ufffd\u0018\ufffd:\"\ufffd\n\u07e1\ufffd;Nid.\ufffd\ufffd0+\ufffd&\ufffd\ufffd`\ufffd\ufffdT\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003b\u00075#xH\u0007\ufffd\u0014\ufffd\u00124\ufffd'\ufffd\u10e5\ufffd\u0001k\u001d\ufffd\ufffd3\ufffdm4\ufffd:+\ufffd \u0004\ufffd\ufffd\u0018\ufffd:\"\ufffd\n\u07e1\ufffd;Nid.\ufffd\ufffd0+\ufffd&\ufffd\ufffd`\ufffd\ufffdT\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \"ka\ufffd\u0005\ufffd,\ufffd\u048a\u0018\ufffd o\t",
"payload_snippet": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003b\u00075#xH\u0007\ufffd\u0014\ufffd\u00124\ufffd'\ufffd\u10e5\ufffd\u0001k\u001d\ufffd\ufffd3\ufffdm4\ufffd:+\ufffd \u0004\ufffd\ufffd\u0018\ufffd:\"\ufffd\n\u07e1\ufffd;Nid.\ufffd\ufffd0+\ufffd&\ufffd\ufffd`\ufffd\ufffdT\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1932d1f933e097fef4fc38cdc66ad75274d46d52",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003b\u00075#xH\u0007\ufffd\u0014\ufffd\u00124\ufffd'\ufffd\u10e5\ufffd\u0001k\u001d\ufffd\ufffd3\ufffdm4\ufffd:+\ufffd \u0004\ufffd\ufffd\u0018\ufffd:\"\ufffd\n\u07e1\ufffd;Nid.\ufffd\ufffd0+\ufffd&\ufffd\ufffd`\ufffd\ufffdT\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 11434,
"service": "ollama",
"service_label_fr": "OLLAMA"
},
"evidence_snippet": "b5#xH\ufffd\ufffd4\ufffd'\ufffd\u10e5\ufffdk\ufffd\ufffd3\ufffdm4\ufffd:+\ufffd \ufffd\ufffd\ufffd:\"\ufffd\n\u07e1\ufffd;Nid.\ufffd\ufffd0+\ufffd&\ufffd\ufffd`\ufffd\ufffdT\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via OLLAMA:11434 \u00b7 (sonde \/ probe)",
"target_port_label": "11434 \u00b7 OLLAMA",
"emulator_service": "ollama",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "ollama",
"service_label_fr": "OLLAMA",
"dst_port": 11434,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-ollama",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\f\u0001\u0000\u0001\b\u0003\u0003b\u00075#xH\u0007\ufffd\u0014\ufffd\u00124\ufffd'\ufffd\u10e5\ufffd\u0001k\u001d\ufffd\ufffd3\ufffdm4\ufffd:+\ufffd \u0004\ufffd\ufffd\u0018\ufffd:\"\ufffd\n\u07e1\ufffd;Nid.\ufffd\ufffd0+\ufffd&\ufffd\ufffd`\ufffd\ufffdT\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"port": 11434,
"service": "ollama",
"service_label_fr": "OLLAMA"
},
"attack_vector": "postgres probe \u00b7 via OLLAMA:11434 \u00b7 (sonde \/ probe)",
"evidence_snippet": "b5#xH\ufffd\ufffd4\ufffd'\ufffd\u10e5\ufffdk\ufffd\ufffd3\ufffdm4\ufffd:+\ufffd \ufffd\ufffd\ufffd:\"\ufffd\n\u07e1\ufffd;Nid.\ufffd\ufffd0+\ufffd&\ufffd\ufffd`\ufffd\ufffdT\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd\ufffd",
"target_port_label": "11434 \u00b7 OLLAMA",
"emulator_service": "ollama",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "ollama",
"service_banner": "honeypot-ollama",
"service_os": "linux",
"dst_port": "11434"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
110 · POP3
|
pop3
|
Sonde port 110/TCP
port 110 tcp · via POP3:110 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
POP3
WAF
—
Recommandation
Surveiller
Tags
net_pop3_probe
pop3_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
110
Chemin / cible
—
Preuve honeypot — Sonde port 110/TCP
Connexion détectée sur le port 110 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_110_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "2b4f4b20504f503320686f6e6579706f742072656164790d0a",
"emulator_response_len": 25,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "DigitalOcean, LLC",
"service": "pop3",
"app_proto": "pop3",
"asn": 14061,
"country": "DE",
"dst_port": 110,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 38,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "0bc29430209a1501e4a4048f59725d53efecdcd6",
"event_fingerprint": "8d5f083aa812a6762c3b48b8375cd32260924478",
"classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "pop3_probe",
"service_name": "pop3",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "dc4164b66ff59a3b1d171afce3368aeb"
},
"target_context": {
"dst_port": 110,
"service": "pop3",
"service_name": "pop3",
"risk_score": 38
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92905bc731f5997d91db958dfa59f6c569432dbe",
"protocol_details": {
"pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
"port": 110,
"service": "pop3",
"service_label_fr": "POP3"
},
"attack_vector": "port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
"target_port_label": "110 \u00b7 POP3",
"emulator_service": "pop3",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "pop3",
"service_label_fr": "POP3",
"dst_port": 110,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pop3",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
"port": 110,
"service": "pop3",
"service_label_fr": "POP3"
},
"attack_vector": "port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "110 \u00b7 POP3",
"emulator_service": "pop3",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pop3",
"service_banner": "honeypot-pop3",
"service_os": "linux",
"dst_port": "110"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_pop3_probe",
"pop3_emulated"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
10250 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:10250 · (tentative d'exploit) · → /v2/_catalog
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /v2/_catalog UA Go-http-client/1.1
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
http_probe_registry
http_ua_suspicious
Cible HTTP
GET
/v2/_catalog
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
10250
Chemin / cible
/v2/_catalog
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 52
Confiance : Confiance 59 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /v2/_catalog HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
GET /v2/_catalog HTTP/1.1
Host: 62.3.50.33:10250
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c6230b8ffdbe5af406d274ad0814962285e74f83",
"http_target_hash": "0a123e4bf77be2af9aa43488b1d007835b4ab56c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 4.914738224920593,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "DE",
"dst_port": 10250,
"risk_waf": 64,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "fa3aab7712a505b5810f791c4560a480f069a78a",
"event_fingerprint": "c49be0e29fa7c97e6cec3c42e06867ecacfd475f",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 52
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "5643008f6012bd29c3bf506fcb9ad098",
"path_pattern_hash": "e619279e9365734b3a57aa3a63edbea8"
},
"target_context": {
"dst_port": 10250,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:10250\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:10250\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:10250\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:10250\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:10250\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "63fbd8f5c70805b758c41710a0bd95f37b684daa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10250,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:10250\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "lfi path traversal \u00b7 via HTTP:10250 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"target_port_label": "10250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 10250,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Kubernetes kubelet",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 10250,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:10250 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:10250\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "10250 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kubelet",
"service_banner": "Kubernetes kubelet",
"service_os": "linux",
"dst_port": "10250"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"http_probe_registry",
"http_ua_suspicious",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /v2/_catalog
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /v2/_catalog UA Go-http-client/1.1
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950316:lfi-14
950468:nosqli-3
http_probe_registry
http_ua_suspicious
Cible HTTP
GET
/v2/_catalog
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8080
Chemin / cible
/v2/_catalog
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 52
Confiance : Confiance 59 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /v2/_catalog HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
lfi-14
nosqli-3
Payload (extrait)
GET /v2/_catalog HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "0a123e4bf77be2af9aa43488b1d007835b4ab56c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 4.94525366001495,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "DE",
"dst_port": 8080,
"risk_waf": 64,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "966b1fe3c738cc9faa5f9ab46a782cbb57093f05",
"event_fingerprint": "3d0306e3dd0eb245eb2d82e49a6e9fc6acc4a3d4",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 52
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "4a8f544d22fd5e1d180aad040fcad97a",
"path_pattern_hash": "e619279e9365734b3a57aa3a63edbea8"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/v2\/_catalog",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950316:lfi-14",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"nosqli-3"
],
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"request_sample": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "649f696d5da3d75ffde47477732bc0455c6f2acf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 64,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/v2\/_catalog",
"request_line": "GET \/v2\/_catalog HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/_catalog",
"evidence_snippet": "GET \/v2\/_catalog HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 64 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950468:nosqli-3",
"http_probe_registry",
"http_ua_suspicious",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
|
|
|
TCP |
18789 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:18789 · (tentative d'exploit) · → /solr/admin/info/system
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/info/system UA Go-http-client/1.1
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
http_probe_solr
Cible HTTP
GET
/solr/admin/info/system
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
18789
Chemin / cible
/solr/admin/info/system
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 1 tag(s) WAF
Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/info/system HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
nosqli-3
Payload (extrait)
GET /solr/admin/info/system HTTP/1.1
Host: 62.3.50.33:18789
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "473c9614888ff9827a98bf7fad6203e6de73b3a4",
"http_target_hash": "fc0e9dcca87dcc3e0fb0c7105f0dc0965b093249",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 115,
"payload_entropy": 4.990651631299231,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "DE",
"dst_port": 18789,
"risk_waf": 32,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "6d0380e4b2d02f540546e75b7303e2cf794367ce",
"event_fingerprint": "8c5c094c102249af809b6360d374a84f06b9fff3",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "656f49e108e132b5b6c366671663e8d4",
"path_pattern_hash": "2bb5950eb761b3b523d8b3a4a96c284e"
},
"target_context": {
"dst_port": 18789,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/info\/system",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950468:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a47e9da93b31556bd69d5f3f0adfc67f8c704d5a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 18789,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:18789 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"target_port_label": "18789 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 32,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18789,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/info\/system",
"request_line": "GET \/solr\/admin\/info\/system HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 18789,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:18789 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/info\/system",
"evidence_snippet": "GET \/solr\/admin\/info\/system HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "18789 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 32 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18789"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
18789 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:18789 · (tentative d'exploit)
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
18789
Chemin / cible
/
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 60
Confiance : Confiance 50 % — 4 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Règles WAF
rce-0
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:18789
User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)
Accept: */*
Acce
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:18789 User-Agent: Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/) Accept: */* Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "033dedd926f028341b5d0b4ba132f8088c552b7c",
"http_host_hash": "473c9614888ff9827a98bf7fad6203e6de73b3a4",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 149,
"payload_entropy": 5.165300252962053,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "DE",
"dst_port": 18789,
"risk_waf": 96,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 60,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "af5c0c7585059b1f68685bb4bde913970de5d654",
"event_fingerprint": "ce6cb0042bb5ce993b1158f967650143759de6b7",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 60
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f9c7ebc5d6f6c8d69ee2392fa6e3a4f",
"payload_hash": "bef144f21007e10f852c27586ea18b94",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 18789,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAcce",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"waf_tags": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAcce",
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aabc05462afde536cc14901fc263e5b1f5d77392",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"port": 18789,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAcce",
"attack_vector": "ssrf attack \u00b7 via HTTP:18789 \u00b7 (tentative d'exploit)",
"target_port_label": "18789 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 96,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18789,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)",
"port": 18789,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf attack \u00b7 via HTTP:18789 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Mozilla\/5.0 (compatible; Odin; https:\/\/docs.getodin.com\/)\r\nAccept: *\/*\r\nAcce",
"target_port_label": "18789 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18789"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 96
}
|
|
|
TCP |
18789 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:18789 · (tentative d'exploit) · → /solr/admin/cores
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /solr/admin/cores UA Go-http-client/1.1
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950325:rce-0
950468:nosqli-3
http_admin_panel_probe
http_admin_panel_scan
Cible HTTP
GET
/solr/admin/cores
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
18789
Chemin / cible
/solr/admin/cores
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 2 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET solr admin
Ligne de requête
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1
Host: 62.3.50.33:18789
User-Agent: Go-http-client/1.1
Connection: close
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 2,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "473c9614888ff9827a98bf7fad6203e6de73b3a4",
"http_target_hash": "6b03df1c77d35ae8990130ccd8ec9b9323ec38c0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 131,
"payload_entropy": 5.113991331111627,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "http",
"app_proto": "http",
"asn": 14061,
"country": "DE",
"dst_port": 18789,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 53,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "cf53c566f728a03ea9aea300c0e3747e61127c1e",
"event_fingerprint": "c0609d332eea6b3f747c70f6f33765b931634fb3",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0754"
],
"matched_pattern_names": [
"ET solr admin"
],
"pattern_ids": [
"pat-0754"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "740897c1e6e679ad64afe92d2f4f6903",
"path_pattern_hash": "0897b296d8a40895c8b3be949b5c73f5"
},
"target_context": {
"dst_port": 18789,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r",
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/solr\/admin\/cores",
"query_string": "action=STATUS&wt=json",
"user_agent": "Go-http-client\/1.1",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"request_sample": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f785cb2fd2b110d584e4ff90b8854d135620aa8d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 18789,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"attack_vector": "config file probe \u00b7 via HTTP:18789 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"target_port_label": "18789 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18789,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/solr\/admin\/cores",
"request_line": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 18789,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:18789 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/solr\/admin\/cores",
"evidence_snippet": "GET \/solr\/admin\/cores?action=STATUS&wt=json HTTP\/1.1\r\nHost: 62.3.50.33:18789\r\nUser-Agent: Go-http-client\/1.1\r\nConnection: close",
"target_port_label": "18789 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18789"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_probe_solr",
"http_sensitive_path",
"http_ua_suspicious"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
18789 · TLS
|
tls
|
Sonde PostgreSQL
postgres probe · via TLS:18789 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 1b9bb541fa237aff SNI 62.3.50.33
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
18789
Chemin / cible
—
Service
TLS
SNI TLS
62.3.50.33
Payload
� �j�0�1�'��ܼ�S���Bi�l)��M���6 P�/�+���� �� / 5� �$�#� � � ��(�'̨̩̪ k g 9 3 = < � �,�0
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �j�0�1�'��ܼ�S���Bi�l)��M���6 P�/�+���� ��
/ 5�
�$�#� � � ��(�'̨̩̪ k g 9 3 = < � �,�0
Requête brute (extrait)
� �j�0�1�'��ܼ�S���Bi�l)��M���6 P�/�+���� �� / 5� �$�#� � � ��(�'̨̩̪ k g 9 3 = < � �,�0 G 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "1b9bb541fa237aff65acf838b154df7f",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 19,
"bytes_in": 201,
"payload_entropy": 5.025182693966401,
"port_category": "registered",
"org": "DigitalOcean, LLC",
"service": "tls",
"app_proto": "tls",
"asn": 14061,
"country": "DE",
"dst_port": 18789,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3a275669509f4aa6fa47502a958a8d355089274e",
"event_fingerprint": "e9d12dfc640d456e89fbaafe422c3dc420a8c1df",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "1b9bb541fa237aff65acf838b154df7f",
"payload_hash": "3c43f5b70c6db311ff44c7d16548127b",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja4": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_version": "0x0303",
"tls_cipher_count": 40,
"tls_sni": "62.3.50.33",
"ja3_client_category": "nmap_scanner"
},
"tls_ja3": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49160-158-157-156-49192-49191-52393-52392-52394-107-103-57-51-22-61-60-4-20-159-21-49196-49200-8-6-3,0-5-10-11-13-65281,23-24-25,0",
"tls_ja4_hash": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_ja4": "t13d0140_c79c1c2c7c3c_40d2e578a3e2",
"tls_version": "0x0303",
"tls_cipher_count": 40,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 18789,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd0\ufffd1\ufffd'\ufffd\u0018\u0016\ufffd\u073c\ufffdS\ufffd\ufffd\ufffdBi\ufffdl\u0006)\ufffd\ufffdM\ufffd\u0002\ufffd\ufffd6\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd0\ufffd1\ufffd'\ufffd\u0018\u0016\ufffd\u073c\ufffdS\ufffd\ufffd\ufffdBi\ufffdl\u0006)\ufffd\ufffdM\ufffd\u0002\ufffd\ufffd6\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000\u0000G\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd0\ufffd1\ufffd'\ufffd\u0018\u0016\ufffd\u073c\ufffdS\ufffd\ufffd\ufffdBi\ufffdl\u0006)\ufffd\ufffdM\ufffd\u0002\ufffd\ufffd6\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "830af8da39c94f23315458748510f57754aface6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd0\ufffd1\ufffd'\ufffd\u0018\u0016\ufffd\u073c\ufffdS\ufffd\ufffd\ufffdBi\ufffdl\u0006)\ufffd\ufffdM\ufffd\u0002\ufffd\ufffd6\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"tls_ja3": "1b9bb541fa237aff65acf838b154df7f",
"tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_sni": "62.3.50.33",
"port": 18789,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd\ufffdj\ufffd0\ufffd1\ufffd'\ufffd\ufffd\u073c\ufffdS\ufffd\ufffd\ufffdBi\ufffdl)\ufffd\ufffdM\ufffd\ufffd\ufffd6P\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0",
"attack_vector": "postgres probe \u00b7 via TLS:18789 \u00b7 (sonde \/ probe)",
"target_port_label": "18789 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 18789,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003j\ufffd0\ufffd1\ufffd'\ufffd\u0018\u0016\ufffd\u073c\ufffdS\ufffd\ufffd\ufffdBi\ufffdl\u0006)\ufffd\ufffdM\ufffd\u0002\ufffd\ufffd6\u0000\u0000P\ufffd\/\ufffd+\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\u0005\u0000\/\u00005\ufffd\u0012\u0000\n\ufffd$\ufffd#\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd(\ufffd'\u0329\u0328\u032a\u0000k\u0000g\u00009\u00003\u0000\u0016\u0000=\u0000<\u0000\u0004\u0000\u0014\u0000\ufffd\u0000\u0015\ufffd,\ufffd0\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000",
"tls_ja3": "1b9bb541fa237aff65acf838b154df7f",
"tls_ja4": "7d55a26b02c27f625ff34bc84f8ab649",
"tls_sni": "62.3.50.33",
"port": 18789,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:18789 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdj\ufffd0\ufffd1\ufffd'\ufffd\ufffd\u073c\ufffdS\ufffd\ufffd\ufffdBi\ufffdl)\ufffd\ufffdM\ufffd\ufffd\ufffd6P\ufffd\/\ufffd+\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\n\/5\ufffd\n\ufffd$\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd'\u0329\u0328\u032akg93=<\ufffd\ufffd,\ufffd0",
"target_port_label": "18789 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "18789"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
995 · POP3S
|
pop3s
|
Sonde port 995/TCP
port 995 tcp · via POP3S:995 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
POP3S
WAF
—
Recommandation
Surveiller
Tags
net_pop3_probe
pop3_starttls
pop3s_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
995
Chemin / cible
—
Preuve honeypot — Sonde port 995/TCP
Connexion détectée sur le port 995 (TCP) du capteur simulé.
Service
POP3S
Payload
STLS
Pourquoi cette classification : Type « port_995_tcp » (signaux protocolaires) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 40
Confiance : Confiance 62 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Signaux
pat-0631
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
POP3S STLS
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "2b4f4b20504f503320686f6e6579706f742072656164790d0a",
"emulator_response_len": 25,
"bytes_in": 6,
"payload_entropy": 2.2516291673878226,
"port_category": "well_known",
"org": "DigitalOcean, LLC",
"service": "pop3s",
"app_proto": "pop3s",
"asn": 14061,
"country": "DE",
"dst_port": 995,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b049da4cb1600894cb1c9237a4611c1485f24e92",
"event_fingerprint": "0353453bbb76e4d6b1b3ea18095b3c0820f92351",
"classification_reason": "Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 69,
"precision_signals": [
"pat-0631",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0631",
"INT-upstream"
],
"matched_patterns": [
"pat-0631"
],
"matched_pattern_names": [
"POP3S STLS"
],
"pattern_ids": [
"pat-0631"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"named_classification_skipped": true,
"named_candidate": "pop3_probe",
"service_name": "pop3s",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 14061,
"org": "DigitalOcean, LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "813470f1db1ec2e7586921e1e8c83ef5",
"path_pattern_hash": "2d7323af9a60223f53b8a7244c835e47"
},
"target_context": {
"dst_port": 995,
"service": "pop3s",
"service_name": "pop3s",
"risk_score": 40
},
"payload_preview": "STLS\r\n",
"request_sample": "STLS\r\n",
"payload_snippet": "STLS",
"evidence": {
"request_sample": "STLS\r\n",
"payload_snippet": "STLS",
"classification_reason": "Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 62%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f6fadcfb93192808ba4aa0046f49ff6f2c9149c",
"protocol_details": {
"pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
"payload_preview": "STLS",
"port": 995,
"service": "pop3s",
"service_label_fr": "POP3S"
},
"evidence_snippet": "STLS",
"attack_vector": "port 995 tcp \u00b7 via POP3S:995 \u00b7 (sonde \/ probe)",
"target_port_label": "995 \u00b7 POP3S",
"emulator_service": "pop3s",
"confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"classification_reason_label_fr": "Type \u00ab port_995_tcp \u00bb (signaux protocolaires) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "pop3s",
"service_label_fr": "POP3S",
"dst_port": 995,
"protocol_emulated": true,
"tags_summary": [
"pat-0631",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0631",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-pop3s",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
"payload_preview": "STLS",
"port": 995,
"service": "pop3s",
"service_label_fr": "POP3S"
},
"attack_vector": "port 995 tcp \u00b7 via POP3S:995 \u00b7 (sonde \/ probe)",
"evidence_snippet": "STLS",
"target_port_label": "995 \u00b7 POP3S",
"emulator_service": "pop3s",
"confidence_reason": "Confiance 62 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "pop3s",
"service_banner": "honeypot-pop3s",
"service_os": "linux",
"dst_port": "995"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_pop3_probe",
"pop3_starttls",
"pop3s_emulated"
],
"asn_dc_heuristic": true
}
|