Renseignement sur les menaces

Singapour

167.99.70.147

FAI DigitalOcean, LLC Première vue 20/07/2026 11:57 UTC Dernière vue 21/07/2026 13:52 UTC Risque Élevé

Période analysée : 2026-04-25 → 2026-07-24

Activité suspecte — risque 59/100 (Moyen) — MITRE TA0001 — confiance 95 % — via HTTP

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Élevé · Risque max (7j) Élevé

Synthèse exécutive

Profil de menace

Score de risque 69/100 Élevé

Première observation 20/07/2026 11:57 UTC

Dernière observation 21/07/2026 13:52 UTC

Événements (période) 1,226

MITRE ATT&CK principal T1083 729 occurrences

Activité suspecte — risque 59/100 (Moyen) — MITRE TA0001 — confiance 95 % — via HTTP

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%

Confiance 95 % — Score WAF 72 · 3 tag(s) WAF

Comparaison ASN / FAI

ASN 14061 · 167.99.64.0/20 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 1,226 événements sur la période pour cette IP.

142.93.55.208 Sonde fichier configuration 24/07/2026 23:00 UTC
146.190.70.246 Sonde fichier configuration 24/07/2026 23:00 UTC
142.93.194.134 SSRF 24/07/2026 23:00 UTC
137.184.55.56 Sonde port 24/07/2026 23:00 UTC
165.227.188.42 Cross-site scripting 24/07/2026 23:00 UTC
64.23.214.73 Sonde port 24/07/2026 23:00 UTC
137.184.13.100 Sonde port 24/07/2026 23:00 UTC
143.198.238.87 Sonde port 24/07/2026 22:59 UTC

Événements (filtres)

1,226

Première observation

20/07/2026 11:57 UTC

Dernière observation

21/07/2026 13:52 UTC

Dernière activité (filtres)

21/07/2026 13:52 UTC

Événements 7j

1,226

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

Singapour unknown unknown

FAI / réseau

Opérateur et dernière activité ban

DigitalOcean, LLC 0 Port 3559 http_smuggling_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

http smuggling probe · via HTTP:3559 · (tentative d'exploit)

Détails protocole

Méthode: POST
Chemin: /
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.…

Aperçu payload

POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:3559 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/5

Port / service

3559 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 95 % — Motif catalogue confirmé · 3 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0842

Confiance

95%

Famille de menace

web_injection

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

1,226 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

1226 événement(s) — page 12/25

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252edebug	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252edebug UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252edebug TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252edebug Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%252eenv%252edebug HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252edebug HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86 Requête brute (extrait) GET /%252eenv%252edebug HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/ Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "ce8a9dd73620cef42f9c421213a697528be041a0", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 455, "payload_entropy": 5.529893342405621, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "5b8d198bedce19db345a93e65b583a7ce0ddf1c7", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278", "payload_hash": "d0abef28888a18cee1fde7da72bd0bc2", "path_pattern_hash": "73a3e4d1477161424c2a45176fc1f863" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252edebug HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86", "method": "GET", "path": "\/%252eenv%252edebug", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252edebug HTTP\/1.1", "request_sample": "GET \/%252eenv%252edebug HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/", "payload_snippet": "GET \/%252eenv%252edebug HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86", "evidence": { "method": "GET", "path": "\/%252eenv%252edebug", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252edebug HTTP\/1.1", "request_sample": "GET \/%252eenv%252edebug HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/", "payload_snippet": "GET \/%252eenv%252edebug HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6210d86190389681a15641455ab007c163063dab", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252edebug", "request_line": "GET \/%252eenv%252edebug HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252edebug HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252edebug", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252edebug", "request_line": "GET \/%252eenv%252edebug HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252edebug", "evidence_snippet": "GET \/%252eenv%252edebug HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252ekeys	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252ekeys UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252ekeys TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252ekeys Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%252eenv%252ekeys HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252ekeys HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPh Requête brute (extrait) GET /%252eenv%252ekeys HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/htm Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "831ab6f3b0a871d3fbd50a21b1f4caa2c53868ce", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 491, "payload_entropy": 5.522307508589746, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "ded52b3d9953c973da5f01843538c4a9474268d5", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c", "payload_hash": "20f37a78d7a274ce0d5d0a14fe4e4e8a", "path_pattern_hash": "c389cd0de39b5445a60de5972af665d7" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252ekeys HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh", "method": "GET", "path": "\/%252eenv%252ekeys", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252ekeys HTTP\/1.1", "request_sample": "GET \/%252eenv%252ekeys HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/htm", "payload_snippet": "GET \/%252eenv%252ekeys HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh", "evidence": { "method": "GET", "path": "\/%252eenv%252ekeys", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252ekeys HTTP\/1.1", "request_sample": "GET \/%252eenv%252ekeys HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/htm", "payload_snippet": "GET \/%252eenv%252ekeys HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a90408946edc624d666f93991facc3fbcc4d7c9b", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252ekeys", "request_line": "GET \/%252eenv%252ekeys HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252ekeys HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ekeys", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252ekeys", "request_line": "GET \/%252eenv%252ekeys HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ekeys", "evidence_snippet": "GET \/%252eenv%252ekeys HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPh", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /sender/.env	Élevée	Élevé · 67
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /sender/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /sender/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /sender/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 67 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /sender/.env HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /sender/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6 Requête brute (extrait) GET /sender/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applicati Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "a4dd6a1600626b70e4070c33743876447e1e78fe", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 458, "payload_entropy": 5.482241525489209, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 67, "tag_count": 7, "anomaly_count": 0, "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca", "event_fingerprint": "6825f437d2677459d21b32a9b124b8209d03b15b", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052", "payload_hash": "cd761845085e4e764f299d17a6ecc3d9", "path_pattern_hash": "35538baaa54858783f9470ffbfc309a8" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 67 }, "payload_preview": "GET \/sender\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "method": "GET", "path": "\/sender\/.env", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/sender\/.env HTTP\/1.1", "request_sample": "GET \/sender\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicati", "payload_snippet": "GET \/sender\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "evidence": { "method": "GET", "path": "\/sender\/.env", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/sender\/.env HTTP\/1.1", "request_sample": "GET \/sender\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicati", "payload_snippet": "GET \/sender\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "39a324eb587cfa44be25a570566f96ac7c273b10", "protocol_details": { "http_method": "GET", "http_path": "\/sender\/.env", "request_line": "GET \/sender\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/sender\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sender\/.env", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 67, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/sender\/.env", "request_line": "GET \/sender\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sender\/.env", "evidence_snippet": "GET \/sender\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252edev	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252edev UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252edev TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252edev Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%252eenv%252edev HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252edev HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPho Requête brute (extrait) GET /%252eenv%252edev HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/html Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "5e592bf35d72cc742b0c8e6b87e92d19b212504b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 490, "payload_entropy": 5.520231094754397, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "7661cf396fb683fa1d72c24359e381e385168851", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c", "payload_hash": "5b28a551a655797e2701b3bbe4d8e791", "path_pattern_hash": "07a9156d183f7a38f8fc010c730bb901" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252edev HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho", "method": "GET", "path": "\/%252eenv%252edev", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252edev HTTP\/1.1", "request_sample": "GET \/%252eenv%252edev HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html", "payload_snippet": "GET \/%252eenv%252edev HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho", "evidence": { "method": "GET", "path": "\/%252eenv%252edev", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252edev HTTP\/1.1", "request_sample": "GET \/%252eenv%252edev HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html", "payload_snippet": "GET \/%252eenv%252edev HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9c6c6eeb22530ff92acfcd06df8c9e925913ae31", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252edev", "request_line": "GET \/%252eenv%252edev HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252edev HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252edev", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252edev", "request_line": "GET \/%252eenv%252edev HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252edev", "evidence_snippet": "GET \/%252eenv%252edev HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPho", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252edevelopment	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252edevelopment UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252edevelopment TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252edevelopment Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%252eenv%252edevelopment HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252edevelopment HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintos Requête brute (extrait) GET /%252eenv%252edevelopment HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/ Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "8de3446f87a620917e28e9a1d7ec968fea34d2af", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 477, "payload_entropy": 5.492804367368875, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "1a6bfcce3d03eef70f02979e1e56e13f15f0bb87", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729", "payload_hash": "225f4c323743ae2bf0fa1667f724491d", "path_pattern_hash": "c190ddcd7deadec123c0affe83da6eec" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252edevelopment HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintos", "method": "GET", "path": "\/%252eenv%252edevelopment", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252edevelopment HTTP\/1.1", "request_sample": "GET \/%252eenv%252edevelopment HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/", "payload_snippet": "GET \/%252eenv%252edevelopment HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintos", "evidence": { "method": "GET", "path": "\/%252eenv%252edevelopment", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252edevelopment HTTP\/1.1", "request_sample": "GET \/%252eenv%252edevelopment HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/", "payload_snippet": "GET \/%252eenv%252edevelopment HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintos", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b9bba9f56a789d934ebe884d7a43d8161d6d20db", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252edevelopment", "request_line": "GET \/%252eenv%252edevelopment HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252edevelopment HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintos", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252edevelopment", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252edevelopment", "request_line": "GET \/%252eenv%252edevelopment HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252edevelopment", "evidence_snippet": "GET \/%252eenv%252edevelopment HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintos", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252eci	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252eci UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252eci TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252eci Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%252eenv%252eci HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252eci HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Requête brute (extrait) GET /%252eenv%252eci HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,appli Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "8297df9b914a4ad03da525e4070c37444c62cb0e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 462, "payload_entropy": 5.514634925636786, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "589b562295125f2b8e59a4fe7738aa8abeacd763", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052", "payload_hash": "6f8809d237763f86b18d96ffe89b3643", "path_pattern_hash": "b214f087b9f2d8ec8ab3b4c29408b863" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; ", "method": "GET", "path": "\/%252eenv%252eci", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252eci HTTP\/1.1", "request_sample": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli", "payload_snippet": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "evidence": { "method": "GET", "path": "\/%252eenv%252eci", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252eci HTTP\/1.1", "request_sample": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli", "payload_snippet": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ec2945266e579616b85ad78bc824bc43893819e", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252eci", "request_line": "GET \/%252eenv%252eci HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eci", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252eci", "request_line": "GET \/%252eenv%252eci HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eci", "evidence_snippet": "GET \/%252eenv%252eci HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /scraper/.env	Élevée	Élevé · 67
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /scraper/.env UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /scraper/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /scraper/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 67 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /scraper/.env HTTP/1.1` User-Agent Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /scraper/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; Requête brute (extrait) GET /scraper/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Accept: Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "ff9f7ef6fd15db1d21061f727c0774088dbb4542", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 500, "payload_entropy": 5.536718755693783, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 67, "tag_count": 7, "anomaly_count": 0, "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca", "event_fingerprint": "c3b1e5d1adb005e7c178cf1e8554e84c93a656b5", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9219a56a94233bae47f378d01e805eeb", "payload_hash": "266e3972b24efa95e6141d63d05ecde0", "path_pattern_hash": "b6ebcc46c6e4dfd75525d5c83228da80" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 67 }, "payload_preview": "GET \/scraper\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; ", "method": "GET", "path": "\/scraper\/.env", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/scraper\/.env HTTP\/1.1", "request_sample": "GET \/scraper\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept:", "payload_snippet": "GET \/scraper\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "evidence": { "method": "GET", "path": "\/scraper\/.env", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/scraper\/.env HTTP\/1.1", "request_sample": "GET \/scraper\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept:", "payload_snippet": "GET \/scraper\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c37256a1fd54ce40a2761b2904c7c9a3abee5cec", "protocol_details": { "http_method": "GET", "http_path": "\/scraper\/.env", "request_line": "GET \/scraper\/.env HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/scraper\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/scraper\/.env", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 67, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/scraper\/.env", "request_line": "GET \/scraper\/.env HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/scraper\/.env", "evidence_snippet": "GET \/scraper\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /security/.env	Élevée	Élevé · 67
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /security/.env UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /security/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /security/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 67 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /security/.env HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /security/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) Requête brute (extrait) GET /security/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "143074197c7cad64c2372a0540c0e56c16e080b0", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 450, "payload_entropy": 5.496394560315678, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 67, "tag_count": 7, "anomaly_count": 0, "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca", "event_fingerprint": "c986c6fe52aa3a3a345999a50763208a8849939b", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278", "payload_hash": "939a32d76e11385097efcecdae0558e4", "path_pattern_hash": "161e59612349d2eed6ae786acc418734" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 67 }, "payload_preview": "GET \/security\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) ", "method": "GET", "path": "\/security\/.env", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/security\/.env HTTP\/1.1", "request_sample": "GET \/security\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q", "payload_snippet": "GET \/security\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)", "evidence": { "method": "GET", "path": "\/security\/.env", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/security\/.env HTTP\/1.1", "request_sample": "GET \/security\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q", "payload_snippet": "GET \/security\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "45a93a297471a151dfb767490ddf8500645abe82", "protocol_details": { "http_method": "GET", "http_path": "\/security\/.env", "request_line": "GET \/security\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/security\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/security\/.env", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 67, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/security\/.env", "request_line": "GET \/security\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/security\/.env", "evidence_snippet": "GET \/security\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252elive	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252elive UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252elive TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252elive Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%252eenv%252elive HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252elive HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0 Requête brute (extrait) GET /%252eenv%252elive HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "fa3ab91836297e013d01488b31065fc5c2b92291", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 478, "payload_entropy": 5.511516072286972, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "bc78ed4d2fc1e179c222ad4417f3e13323727621", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "817ecf5c09543bd892aad44157e9396f", "payload_hash": "c8eab7cb7da3ce7c747fa11231455e2e", "path_pattern_hash": "3b6160b80f534f74bccaa117a3ccf7b5" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252elive HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "method": "GET", "path": "\/%252eenv%252elive", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252elive HTTP\/1.1", "request_sample": "GET \/%252eenv%252elive HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application", "payload_snippet": "GET \/%252eenv%252elive HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "evidence": { "method": "GET", "path": "\/%252eenv%252elive", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252elive HTTP\/1.1", "request_sample": "GET \/%252eenv%252elive HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application", "payload_snippet": "GET \/%252eenv%252elive HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eedd59209d2054671472e35b13688473ab07f513", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252elive", "request_line": "GET \/%252eenv%252elive HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252elive HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252elive", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252elive", "request_line": "GET \/%252eenv%252elive HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252elive", "evidence_snippet": "GET \/%252eenv%252elive HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252ebkp	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252ebkp UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252ebkp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252ebkp Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%252eenv%252ebkp HTTP/1.1` User-Agent Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252ebkp HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7 Requête brute (extrait) GET /%252eenv%252ebkp HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Acc Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "c40e28dccb163b1339728c3a3532c4efd200349a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 504, "payload_entropy": 5.571758745725203, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "3ecf397825b9736241b74ac2e3dd73cb61868349", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9219a56a94233bae47f378d01e805eeb", "payload_hash": "dee035faaaa3221fb273e7c5c2f9c4ca", "path_pattern_hash": "a22d3045fe7f20fecb32decca8247302" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7", "method": "GET", "path": "\/%252eenv%252ebkp", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252ebkp HTTP\/1.1", "request_sample": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcc", "payload_snippet": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7", "evidence": { "method": "GET", "path": "\/%252eenv%252ebkp", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252ebkp HTTP\/1.1", "request_sample": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAcc", "payload_snippet": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9db8db99af0542e7398e1b4daeef03b6f065911e", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252ebkp", "request_line": "GET \/%252eenv%252ebkp HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ebkp", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252ebkp", "request_line": "GET \/%252eenv%252ebkp HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ebkp", "evidence_snippet": "GET \/%252eenv%252ebkp HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252ehomestead	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252ehomestead UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252ehomestead TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252ehomestead Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%252eenv%252ehomestead HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252ehomestead HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Linux; And Requête brute (extrait) GET /%252eenv%252ehomestead HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/x Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "eb3da512c07c070d808526b67ae6316193647a6b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 476, "payload_entropy": 5.514570091788129, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "6aebe66dafbd4c97a0c623158b60f48652b0582e", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b6437c44634b78992a7fb87fd879dbec", "payload_hash": "409094ab7402b314af60be1f0c3c800c", "path_pattern_hash": "1704d4553d585a7b9599f3c0880e9117" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252ehomestead HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "method": "GET", "path": "\/%252eenv%252ehomestead", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252ehomestead HTTP\/1.1", "request_sample": "GET \/%252eenv%252ehomestead HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/x", "payload_snippet": "GET \/%252eenv%252ehomestead HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "evidence": { "method": "GET", "path": "\/%252eenv%252ehomestead", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252ehomestead HTTP\/1.1", "request_sample": "GET \/%252eenv%252ehomestead HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/x", "payload_snippet": "GET \/%252eenv%252ehomestead HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "931d266c2648fe55649c3df339e5e462084c6dfb", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252ehomestead", "request_line": "GET \/%252eenv%252ehomestead HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252ehomestead HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ehomestead", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252ehomestead", "request_line": "GET \/%252eenv%252ehomestead HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252ehomestead", "evidence_snippet": "GET \/%252eenv%252ehomestead HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252e3	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252e3 UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252e3 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252e3 Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%252eenv%252e3 HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252e3 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) Requête brute (extrait) GET /%252eenv%252e3 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml; Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "9ab0fd604172d72dbb35e3f90e0afbd4d6d4fdde", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 451, "payload_entropy": 5.524307899769047, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "c6719d36ed46f8894c39c3e6bccf86458060efa1", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278", "payload_hash": "ec8d3ed379f0f0018a7a4a42a08c094a", "path_pattern_hash": "b8c83dfaa0052e3797559a11e2742caa" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)", "method": "GET", "path": "\/%252eenv%252e3", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252e3 HTTP\/1.1", "request_sample": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;", "payload_snippet": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)", "evidence": { "method": "GET", "path": "\/%252eenv%252e3", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252e3 HTTP\/1.1", "request_sample": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;", "payload_snippet": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "aecb1acdca9c3c1e9d1067e1eb180d9d75144c44", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252e3", "request_line": "GET \/%252eenv%252e3 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e3", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252e3", "request_line": "GET \/%252eenv%252e3 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e3", "evidence_snippet": "GET \/%252eenv%252e3 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /search/.env	Élevée	Élevé · 67
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /search/.env UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /search/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /search/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 67 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /search/.env HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /search/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv Requête brute (extrait) GET /search/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q= Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "39a511a9a3ea04d3dc152ba68218751aee3100f4", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 417, "payload_entropy": 5.443389066835848, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 67, "tag_count": 7, "anomaly_count": 0, "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca", "event_fingerprint": "9086accefc8947b3f3e20c9ac36be9b947fd3810", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36", "payload_hash": "d4091ac8cabbf6df3940c2a2abf71839", "path_pattern_hash": "1bdff2eaac62e52ddfbf09ec65bee87d" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 67 }, "payload_preview": "GET \/search\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv", "method": "GET", "path": "\/search\/.env", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/search\/.env HTTP\/1.1", "request_sample": "GET \/search\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,\/;q=", "payload_snippet": "GET \/search\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv", "evidence": { "method": "GET", "path": "\/search\/.env", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/search\/.env HTTP\/1.1", "request_sample": "GET \/search\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,\/;q=", "payload_snippet": "GET \/search\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4cad5dbb424247cefea0c7e4d48cbb95f1cf9bb0", "protocol_details": { "http_method": "GET", "http_path": "\/search\/.env", "request_line": "GET \/search\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/search\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/search\/.env", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 67, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/search\/.env", "request_line": "GET \/search\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/search\/.env", "evidence_snippet": "GET \/search\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252eheroku	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252eheroku UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252eheroku TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252eheroku Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%252eenv%252eheroku HTTP/1.1` User-Agent Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252eheroku HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Androi Requête brute (extrait) GET /%252eenv%252eheroku HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "b993cd0331ea7e43c0d80653de82ab833792e090", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 507, "payload_entropy": 5.569304590041565, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "d0b987348db7751c45544d2d5bb1a94e7d0fae4b", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9219a56a94233bae47f378d01e805eeb", "payload_hash": "ebca84c2c6e1fc9d189c37efbbfa791f", "path_pattern_hash": "b48f4cd36ec488b8aa2a2a0855e2886e" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252eheroku HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Androi", "method": "GET", "path": "\/%252eenv%252eheroku", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252eheroku HTTP\/1.1", "request_sample": "GET \/%252eenv%252eheroku HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\n", "payload_snippet": "GET \/%252eenv%252eheroku HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Androi", "evidence": { "method": "GET", "path": "\/%252eenv%252eheroku", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252eheroku HTTP\/1.1", "request_sample": "GET \/%252eenv%252eheroku HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\n", "payload_snippet": "GET \/%252eenv%252eheroku HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Androi", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "85a70622a364b1cfab1d6c80bb38776ff6c9be47", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252eheroku", "request_line": "GET \/%252eenv%252eheroku HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252eheroku HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Androi", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eheroku", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252eheroku", "request_line": "GET \/%252eenv%252eheroku HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252eheroku", "evidence_snippet": "GET \/%252eenv%252eheroku HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Androi", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%252eenv HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; Requête brute (extrait) GET /%252eenv HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xhtml+xm Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "602572890be4ecc5994f5b4792e12cf4b95b4a5e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 469, "payload_entropy": 5.506840848354185, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "aa9ef072cf9dd55db117d22d886d4241bcfffc14", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "817ecf5c09543bd892aad44157e9396f", "payload_hash": "e45d86d566e0b8d15b84faca1f6d79a2", "path_pattern_hash": "3719eaa71085284ca4f84e736ffb42e2" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ", "method": "GET", "path": "\/%252eenv", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv HTTP\/1.1", "request_sample": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+xm", "payload_snippet": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "evidence": { "method": "GET", "path": "\/%252eenv", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv HTTP\/1.1", "request_sample": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xhtml+xm", "payload_snippet": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e2b1afc819d4bc7e10a31f48c32f745bb9d9342e", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv", "request_line": "GET \/%252eenv HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv", "request_line": "GET \/%252eenv HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv", "evidence_snippet": "GET \/%252eenv HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252e0	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252e0 UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252e0 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252e0 Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%252eenv%252e0 HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252e0 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone Requête brute (extrait) GET /%252eenv%252e0 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/html,a Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "f093ef84f83887d5dce53a567e1835924ccdee0d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 488, "payload_entropy": 5.518735581255798, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "c7516ff9c8a169596671f245c6d690f97c8dfc89", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c", "payload_hash": "2abf9c17ccb52af3b27d0330d91e4661", "path_pattern_hash": "0d9bb343dbaff2bdb52727f3a34113cf" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "method": "GET", "path": "\/%252eenv%252e0", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252e0 HTTP\/1.1", "request_sample": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,a", "payload_snippet": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "evidence": { "method": "GET", "path": "\/%252eenv%252e0", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252e0 HTTP\/1.1", "request_sample": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,a", "payload_snippet": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e510ba18debef1b29d42c7f1d3ac0c969278c4a2", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252e0", "request_line": "GET \/%252eenv%252e0 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e0", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252e0", "request_line": "GET \/%252eenv%252e0 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252e0", "evidence_snippet": "GET \/%252eenv%252e0 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /scanner/.env	Élevée	Élevé · 67
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /scanner/.env UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /scanner/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /scanner/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 67 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /scanner/.env HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /scanner/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Linux; Android 14; S Requête brute (extrait) GET /scanner/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,a Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "3cb8abcfc5acdbc07c7ec8ac790a0b9f683aff35", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 466, "payload_entropy": 5.488206497833284, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 67, "tag_count": 7, "anomaly_count": 0, "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca", "event_fingerprint": "cf72f2782bdcf6e471d7921131be7ce97ff1eebf", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b6437c44634b78992a7fb87fd879dbec", "payload_hash": "5e2e5152d3919729922f8d77a8dbec6a", "path_pattern_hash": "0863eeced887c79ffeac44733c4a53b0" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 67 }, "payload_preview": "GET \/scanner\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "method": "GET", "path": "\/scanner\/.env", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/scanner\/.env HTTP\/1.1", "request_sample": "GET \/scanner\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,a", "payload_snippet": "GET \/scanner\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "evidence": { "method": "GET", "path": "\/scanner\/.env", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/scanner\/.env HTTP\/1.1", "request_sample": "GET \/scanner\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,a", "payload_snippet": "GET \/scanner\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "41e7f0e08cf61c1766f490de25a183b132170c14", "protocol_details": { "http_method": "GET", "http_path": "\/scanner\/.env", "request_line": "GET \/scanner\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/scanner\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/scanner\/.env", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 67, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/scanner\/.env", "request_line": "GET \/scanner\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/scanner\/.env", "evidence_snippet": "GET \/scanner\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%252eenv%252edatabase	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%252eenv%252edatabase UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_path_traversal Cible HTTP GET /%252eenv%252edatabase TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%252eenv%252edatabase Service HTTP Pourquoi cette classification : Traversal / LFI dans le chemin · confiance 100% Confiance classification 100% Risque capteur Élevé · 65 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%252eenv%252edatabase HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%252eenv%252edatabase HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU Requête brute (extrait) GET /%252eenv%252edatabase HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "25f22aa83084d5f5512987f03353c08618ea9d67", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 495, "payload_entropy": 5.513285043014963, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 5, "anomaly_count": 0, "campaign_key": "f4bf5706f596e609e4f89e4db0416f4cc8ea161e", "event_fingerprint": "d9e6c523cb2c0ff938495a308c06087c172c3016", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c", "payload_hash": "f193e4082ca4d7e0cba991939d37fefa", "path_pattern_hash": "93c5d97d8adc92e0fb51c3454319c69e" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/%252eenv%252edatabase HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU", "method": "GET", "path": "\/%252eenv%252edatabase", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252edatabase HTTP\/1.1", "request_sample": "GET \/%252eenv%252edatabase HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text", "payload_snippet": "GET \/%252eenv%252edatabase HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU", "evidence": { "method": "GET", "path": "\/%252eenv%252edatabase", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%252eenv%252edatabase HTTP\/1.1", "request_sample": "GET \/%252eenv%252edatabase HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text", "payload_snippet": "GET \/%252eenv%252edatabase HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU", "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "680bd3e0224d140793fd4696031ea47382c5cf52", "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252edatabase", "request_line": "GET \/%252eenv%252edatabase HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%252eenv%252edatabase HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252edatabase", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "classification_reason_label_fr": "Traversal \/ LFI dans le chemin \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 65 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%252eenv%252edatabase", "request_line": "GET \/%252eenv%252edatabase HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%252eenv%252edatabase", "evidence_snippet": "GET \/%252eenv%252edatabase HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_path_traversal", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:06 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /sdk/.env	Élevée	Élevé · 67
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /sdk/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /sdk/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /sdk/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 67 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /sdk/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /sdk/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS Requête brute (extrait) GET /sdk/.env HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applic Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "2b91afc65684a6ac54b3203d6bf968ac7ea7cd17", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 461, "payload_entropy": 5.494375998554694, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 67, "tag_count": 7, "anomaly_count": 0, "campaign_key": "960ed25de9f55853a8665c8717e8349e4661e6ca", "event_fingerprint": "768925107f07ad8816a8ab66dbb6f45247f97b7c", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf", "payload_hash": "0d4231770d5608ac2d54aa4b1aba2aea", "path_pattern_hash": "690663750b82437fa843de0120a3a2ca" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 67 }, "payload_preview": "GET \/sdk\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS ", "method": "GET", "path": "\/sdk\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/sdk\/.env HTTP\/1.1", "request_sample": "GET \/sdk\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic", "payload_snippet": "GET \/sdk\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "evidence": { "method": "GET", "path": "\/sdk\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/sdk\/.env HTTP\/1.1", "request_sample": "GET \/sdk\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applic", "payload_snippet": "GET \/sdk\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fb0973a74e0dd3e715fd552b66922e47b28f1578", "protocol_details": { "http_method": "GET", "http_path": "\/sdk\/.env", "request_line": "GET \/sdk\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/sdk\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sdk\/.env", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 67 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 67, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/sdk\/.env", "request_line": "GET \/sdk\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sdk\/.env", "evidence_snippet": "GET \/sdk\/.env HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76.%6c%69%76%65	Élevée	Moyen · 63
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76.%6c%69%76%65 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.%65%6e%76.%6c%69%76%65 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76.%6c%69%76%65 Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 63 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (W Requête brute (extrait) GET /.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0. Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%6c%69%76%65", "http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "60d7e101675afa07cd4f05ac15aa3d0007af25e3", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 447, "payload_entropy": 5.530348703449418, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 25 }, "risk_score": 63, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3883cd23d007630c9a842db5f904c909faf2c43", "event_fingerprint": "fac1d6ae3a92fe405b1f0a1a906e79d9a8f00a85", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 25, "risk_score": 63 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71", "payload_hash": "006fb9910983c967a17111ab4272e42a", "path_pattern_hash": "d222f036bd9e4fce592afeca88e8562b" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 63 }, "payload_preview": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "method": "GET", "path": "\/.%65%6e%76.%6c%69%76%65", "query_string": "v=0PnFg", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.", "payload_snippet": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "evidence": { "method": "GET", "path": "\/.%65%6e%76.%6c%69%76%65", "query_string": "v=0PnFg", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.", "payload_snippet": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2a2936fb170732b40c59fa155790169cecd77c0b", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%6c%69%76%65", "request_line": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%6c%69%76%65", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 25, "risk_score": 63 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 63, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%6c%69%76%65", "request_line": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%6c%69%76%65", "evidence_snippet": "GET \/.%65%6e%76.%6c%69%76%65?v=0PnFg HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76.%6a%73%6f%6e	Élevée	Moyen · 63
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76.%6a%73%6f%6e UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.%65%6e%76.%6a%73%6f%6e TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76.%6a%73%6f%6e Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 63 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (W Requête brute (extrait) GET /.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%6a%73%6f%6e", "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "6721680b4d4ce9388d8452ff8da63c0702473b6c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 478, "payload_entropy": 5.566915497873953, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 25 }, "risk_score": 63, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3883cd23d007630c9a842db5f904c909faf2c43", "event_fingerprint": "30728f87c23e185634af218f4d6a8db4be9a4e23", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 25, "risk_score": 63 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052", "payload_hash": "7d94f54753d0d8462a71f8d80c9b88d0", "path_pattern_hash": "0a7a230c20ae8d7be45c879ba85028d8" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 63 }, "payload_preview": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "method": "GET", "path": "\/.%65%6e%76.%6a%73%6f%6e", "query_string": "v=BPicQ", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application", "payload_snippet": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "evidence": { "method": "GET", "path": "\/.%65%6e%76.%6a%73%6f%6e", "query_string": "v=BPicQ", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application", "payload_snippet": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fd63c23da083a86f1a14635f17e8ef599cdb9d67", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%6a%73%6f%6e", "request_line": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%6a%73%6f%6e", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 25, "risk_score": 63 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 63, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%6a%73%6f%6e", "request_line": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%6a%73%6f%6e", "evidence_snippet": "GET \/.%65%6e%76.%6a%73%6f%6e?v=BPicQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (W", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76.%64%65%76	Élevée	Moyen · 63
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76.%64%65%76 UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.%65%6e%76.%64%65%76 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76.%64%65%76 Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 63 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.%65%6e%76.%64%65%76?v=un2rQ HTTP/1.1` User-Agent Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.%65%6e%76.%64%65%76?v=un2rQ HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linu Requête brute (extrait) GET /.%65%6e%76.%64%65%76?v=un2rQ HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%64%65%76", "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "3dfb53d9d6f3490124ed2cad7a7cc9f4fd5d3da0", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 516, "payload_entropy": 5.6157524327525445, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.2, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 25 }, "risk_score": 63, "tag_count": 5, "anomaly_count": 0, "campaign_key": "e3883cd23d007630c9a842db5f904c909faf2c43", "event_fingerprint": "670d05e3c0c94c47d7c2720a7dfc05a695cac2b5", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 25, "risk_score": 63 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9219a56a94233bae47f378d01e805eeb", "payload_hash": "cf18a6cfc383211bf14d12a38eaf05f6", "path_pattern_hash": "e3bcd527d69264b3ef51e0d1b3081293" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 63 }, "payload_preview": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linu", "method": "GET", "path": "\/.%65%6e%76.%64%65%76", "query_string": "v=un2rQ", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari", "payload_snippet": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linu", "evidence": { "method": "GET", "path": "\/.%65%6e%76.%64%65%76", "query_string": "v=un2rQ", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari", "payload_snippet": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linu", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "31f6c5890815c5ee9aacf0ccff551debb929c97e", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%64%65%76", "request_line": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linu", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%64%65%76", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 25, "risk_score": 63 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 63, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%64%65%76", "request_line": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%64%65%76", "evidence_snippet": "GET \/.%65%6e%76.%64%65%76?v=un2rQ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linu", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76.%33	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76.%33 UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.%65%6e%76.%33 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76.%33 Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.%65%6e%76.%33?v=z5OCt HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.%65%6e%76.%33?v=z5OCt HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Linux; And Requête brute (extrait) GET /.%65%6e%76.%33?v=z5OCt HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/html,application/x Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%33", "http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "a3289927cb9c23c8026d077c2481081e7abd2ffa", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 476, "payload_entropy": 5.5664051834972055, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "c7ed1233b7c6113fe8fe0bcf91a0b3dfb416fc51", "event_fingerprint": "a7c8f01fef1357955ac7b3ae1eb41174ff8bac3d", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b6437c44634b78992a7fb87fd879dbec", "payload_hash": "d324f07b6c6a684324a7036cb3ea03ca", "path_pattern_hash": "5902dc6ca69e452f4ae2ba8f7c698830" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "method": "GET", "path": "\/.%65%6e%76.%33", "query_string": "v=z5OCt", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/x", "payload_snippet": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "evidence": { "method": "GET", "path": "\/.%65%6e%76.%33", "query_string": "v=z5OCt", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/x", "payload_snippet": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cfa237c3183830efba775f463ff23c364b90854b", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%33", "request_line": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%33", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%33", "request_line": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%33", "evidence_snippet": "GET \/.%65%6e%76.%33?v=z5OCt HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; And", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76.%63%72%65%64%73	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76.%63%72%65%64%73 UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.%65%6e%76.%63%72%65%64%73 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76.%63%72%65%64%73 Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP/1.1` User-Agent Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 Requête brute (extrait) GET /.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%63%72%65%64%73", "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "c799d2918007219fe7415fe72f362305f6b7bb02", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 522, "payload_entropy": 5.620664747167313, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "c7ed1233b7c6113fe8fe0bcf91a0b3dfb416fc51", "event_fingerprint": "e60cb4196773b1165a889761f5ed19af2476365c", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9219a56a94233bae47f378d01e805eeb", "payload_hash": "d12da8cad876e7ef17e56420e067323a", "path_pattern_hash": "0ad51c49ff753d173ed4e40a6a4dbe70" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0", "method": "GET", "path": "\/.%65%6e%76.%63%72%65%64%73", "query_string": "v=MSmgP", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie ", "payload_snippet": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0", "evidence": { "method": "GET", "path": "\/.%65%6e%76.%63%72%65%64%73", "query_string": "v=MSmgP", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie ", "payload_snippet": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b35b23ac7b33ddc2c41909b3baa3cb9c99609bb4", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%63%72%65%64%73", "request_line": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%72%65%64%73", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%63%72%65%64%73", "request_line": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%63%72%65%64%73", "evidence_snippet": "GET \/.%65%6e%76.%63%72%65%64%73?v=MSmgP HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 84 }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.integration	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.integration UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.integration TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.integration Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.integration HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.integration HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; In Requête brute (extrait) GET /%00.env.integration HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "integration", "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "f38028e9457fefc3fc8b8212a3c29704de57b0fd", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 472, "payload_entropy": 5.478806241636321, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "c67166c23e143d59af9615d8b86a5d90e725161b", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf", "payload_hash": "244215a025a98b5d82a9b2798221a583", "path_pattern_hash": "4251f002fd570c24b9f1ebea46723f76" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.integration HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In", "method": "GET", "path": "\/%00.env.integration", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.integration HTTP\/1.1", "request_sample": "GET \/%00.env.integration HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml", "payload_snippet": "GET \/%00.env.integration HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In", "evidence": { "method": "GET", "path": "\/%00.env.integration", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.integration HTTP\/1.1", "request_sample": "GET \/%00.env.integration HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml", "payload_snippet": "GET \/%00.env.integration HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4859e23361455f4b74948085d39ac648d1a3b7a3", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.integration", "request_line": "GET \/%00.env.integration HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.integration HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.integration", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.integration", "request_line": "GET \/%00.env.integration HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.integration", "evidence_snippet": "GET \/%00.env.integration HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.custom	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.custom UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.custom TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.custom Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.custom HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.custom HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel M Requête brute (extrait) GET /%00.env.custom HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml, Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "custom", "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "c67180ebaf7543bccb6c5182a8b0f980039f184b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 467, "payload_entropy": 5.495545652414978, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "42b11fac8eb5e25c1e02bec2d0fce85518de8ad6", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf", "payload_hash": "6b2263f5a17318bc5886a13a9e88fc2c", "path_pattern_hash": "4be5cb5a3e633cea65106d59a3d78de3" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "method": "GET", "path": "\/%00.env.custom", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.custom HTTP\/1.1", "request_sample": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,", "payload_snippet": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "evidence": { "method": "GET", "path": "\/%00.env.custom", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.custom HTTP\/1.1", "request_sample": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,", "payload_snippet": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "261ee84fdd8c08e84beadead0dcdcb88677e2277", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.custom", "request_line": "GET \/%00.env.custom HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.custom", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.custom", "request_line": "GET \/%00.env.custom HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.custom", "evidence_snippet": "GET \/%00.env.custom HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.orig	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.orig UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.orig TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.orig Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%00.env.orig HTTP/1.1` User-Agent Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.orig HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; Requête brute (extrait) GET /%00.env.orig HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Accept: Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "orig", "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "738047786b5d4cbf4afacdb4ec83408300c2b45d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 500, "payload_entropy": 5.549350051109734, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "e679c543037180642d4c6df15ca6ad2542279316", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9219a56a94233bae47f378d01e805eeb", "payload_hash": "b7fe3427dbd88e7a0cfcb8b2084ee835", "path_pattern_hash": "7bd2682d2a840913d3ce2c9754d7c529" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.orig HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; ", "method": "GET", "path": "\/%00.env.orig", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.orig HTTP\/1.1", "request_sample": "GET \/%00.env.orig HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept:", "payload_snippet": "GET \/%00.env.orig HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "evidence": { "method": "GET", "path": "\/%00.env.orig", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.orig HTTP\/1.1", "request_sample": "GET \/%00.env.orig HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept:", "payload_snippet": "GET \/%00.env.orig HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "93db1e2bccdb0f534c1759246040adf820209a8f", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.orig", "request_line": "GET \/%00.env.orig HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.orig HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.orig", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.orig", "request_line": "GET \/%00.env.orig HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.orig", "evidence_snippet": "GET \/%00.env.orig HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.beta	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.beta UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.beta TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.beta Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.beta HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.beta HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) A Requête brute (extrait) GET /%00.env.beta HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q= Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "beta", "http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "edb4ed62eb187c93b0c15fa6371183a4e4cf365d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 449, "payload_entropy": 5.50233693037713, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "fc3fd713e3bb89587888a49344f1412c24aecd89", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278", "payload_hash": "2268826700c9ff4bfc445fda6a3cdca6", "path_pattern_hash": "6863525454a7b607b665c23cb4561cd5" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "method": "GET", "path": "\/%00.env.beta", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.beta HTTP\/1.1", "request_sample": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=", "payload_snippet": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "evidence": { "method": "GET", "path": "\/%00.env.beta", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.beta HTTP\/1.1", "request_sample": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=", "payload_snippet": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b91177b571893c538091526269dccc0af21dadf9", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.beta", "request_line": "GET \/%00.env.beta HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.beta", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.beta", "request_line": "GET \/%00.env.beta HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.beta", "evidence_snippet": "GET \/%00.env.beta HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.contracts	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.contracts UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.contracts TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.contracts Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.contracts HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.contracts HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0 Requête brute (extrait) GET /%00.env.contracts HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,app Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "contracts", "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "496627dfccbb848d2dde28a01d47a8c7230fdc88", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 464, "payload_entropy": 5.4869680189747605, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "64387f3ed44ab4b803a47db4c4cdc7b225a60328", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052", "payload_hash": "5ddfab92eb4a3b0232d961a40293ce0b", "path_pattern_hash": "5833cc19673c8ad1264563ff71175151" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.contracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "method": "GET", "path": "\/%00.env.contracts", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.contracts HTTP\/1.1", "request_sample": "GET \/%00.env.contracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app", "payload_snippet": "GET \/%00.env.contracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "evidence": { "method": "GET", "path": "\/%00.env.contracts", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.contracts HTTP\/1.1", "request_sample": "GET \/%00.env.contracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app", "payload_snippet": "GET \/%00.env.contracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e4830c0c203677c1e3b464df639689e82ffa9324", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.contracts", "request_line": "GET \/%00.env.contracts HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.contracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.contracts", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.contracts", "request_line": "GET \/%00.env.contracts HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.contracts", "evidence_snippet": "GET \/%00.env.contracts HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.mysql	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.mysql UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.mysql TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.mysql Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.mysql HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.mysql HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Ma Requête brute (extrait) GET /%00.env.mysql HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,a Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "mysql", "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "126d5fe3bd05e5f06d002c6197f0d454a5c1e636", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 466, "payload_entropy": 5.503326131339815, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "d3b3d2f129828ab2d4cc4840a06155df53bbe3e6", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf", "payload_hash": "5c9215c14cfe9d989c7d7ac50a82ceac", "path_pattern_hash": "1b70191738ea330ec5edcb8e859177ef" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.mysql HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma", "method": "GET", "path": "\/%00.env.mysql", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.mysql HTTP\/1.1", "request_sample": "GET \/%00.env.mysql HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,a", "payload_snippet": "GET \/%00.env.mysql HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma", "evidence": { "method": "GET", "path": "\/%00.env.mysql", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.mysql HTTP\/1.1", "request_sample": "GET \/%00.env.mysql HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,a", "payload_snippet": "GET \/%00.env.mysql HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9cb74357c3e66db803c2426323d8a1bcc0ac087b", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.mysql", "request_line": "GET \/%00.env.mysql HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.mysql HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.mysql", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.mysql", "request_line": "GET \/%00.env.mysql HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.mysql", "evidence_snippet": "GET \/%00.env.mysql HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76.%62%61%6b	Élevée	Élevé · 68
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76.%62%61%6b UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb… Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 950521:leak-8 Cible HTTP GET /.%65%6e%76.%62%61%6b TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76.%62%61%6b Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 68 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.%65%6e%76.%62%61%6b?v=14WR4 HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 leak-8 Payload (extrait) GET /.%65%6e%76.%62%61%6b?v=14WR4 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPho Requête brute (extrait) GET /.%65%6e%76.%62%61%6b?v=14WR4 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accep Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%62%61%6b", "http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "988dd692cb79c154ceddbb91ef434ec5e0be7494", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 502, "payload_entropy": 5.58137884074282, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 68, "tag_count": 9, "anomaly_count": 0, "campaign_key": "ea820f006837f6167995ab27e77d5cde16738e58", "event_fingerprint": "53a97b5aea6b1c7aebd0ff6763c6c11022851127", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 68 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c", "payload_hash": "b7382d324119192f89b34250300aa147", "path_pattern_hash": "592664d09a1fcb26d74680ecafcb856a" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 68 }, "payload_preview": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPho", "method": "GET", "path": "\/.%65%6e%76.%62%61%6b", "query_string": "v=14WR4", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "950521:leak-8" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1", "leak-8" ], "request_line": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccep", "payload_snippet": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPho", "evidence": { "method": "GET", "path": "\/.%65%6e%76.%62%61%6b", "query_string": "v=14WR4", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "950521:leak-8" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1", "leak-8" ], "request_line": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccep", "payload_snippet": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPho", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f3d4ffe35bf43db3f46e9d192caf08a038eebbce", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%62%61%6b", "request_line": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPho", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%61%6b", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 68 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 68, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%62%61%6b", "request_line": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%62%61%6b", "evidence_snippet": "GET \/.%65%6e%76.%62%61%6b?v=14WR4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPho", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "950521:leak-8", "http_backup_file_scan", "http_backup_path", "http_probe_env", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.new	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.new UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.new TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.new Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.new HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.new HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6 Requête brute (extrait) GET /%00.env.new HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,applicati Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "new", "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "d07c972b2c25035c9736fe07a8f35c01e16e1338", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 458, "payload_entropy": 5.49642125346741, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "ddb538251947f7bb019677ab1c975c9a9fce1840", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052", "payload_hash": "e0a533ebc590dcd58bfffc7a8d93b89d", "path_pattern_hash": "ca24867c062b80a24a36a17a67530912" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.new HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "method": "GET", "path": "\/%00.env.new", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.new HTTP\/1.1", "request_sample": "GET \/%00.env.new HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicati", "payload_snippet": "GET \/%00.env.new HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "evidence": { "method": "GET", "path": "\/%00.env.new", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.new HTTP\/1.1", "request_sample": "GET \/%00.env.new HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,applicati", "payload_snippet": "GET \/%00.env.new HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ff1546b940c7e501795e63d88a04f94dcb11ef29", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.new", "request_line": "GET \/%00.env.new HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.new HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.new", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.new", "request_line": "GET \/%00.env.new HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.new", "evidence_snippet": "GET \/%00.env.new HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 84 }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76 UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.%65%6e%76 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76 Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.%65%6e%76?v=7yvqB HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.%65%6e%76?v=7yvqB HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iP Requête brute (extrait) GET /.%65%6e%76?v=7yvqB HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/ht Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%65%6e%76", "http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "0fae8bf826e9dd776e79b98b589f0769bd37b663", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 492, "payload_entropy": 5.573148914175855, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 7, "anomaly_count": 0, "campaign_key": "575992cb65acdd079a2594cbf23dc2c72c69bdcc", "event_fingerprint": "dd9fd2fbded474a17dc1be5d2a2ac0646b975b5c", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c", "payload_hash": "ce305d601496ea7aa49137941b714b60", "path_pattern_hash": "9e1d0dff23923a351b293be1ba6d6036" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "method": "GET", "path": "\/.%65%6e%76", "query_string": "v=7yvqB", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1", "request_sample": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/ht", "payload_snippet": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "evidence": { "method": "GET", "path": "\/.%65%6e%76", "query_string": "v=7yvqB", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1", "request_sample": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/ht", "payload_snippet": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "96d3a9878ddf8a3066ea75f758db6856935b8eeb", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76", "request_line": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76", "request_line": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76", "evidence_snippet": "GET \/.%65%6e%76?v=7yvqB HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_probe_env", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.1	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.1 UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.1 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.1 Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.1 HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS Requête brute (extrait) GET /%00.env.1 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml,appli Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "1", "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "73ff02bc8b3a251cb7b30e9d012b28eb5040c6d3", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 462, "payload_entropy": 5.49340301364373, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "456b73bab5df1ffe7dc046a30c515d14645431bd", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729", "payload_hash": "c20197bb8572d8cf57fb8dd1d389cd6e", "path_pattern_hash": "36fe9c8463bdcd939509a424d7fb3aec" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "method": "GET", "path": "\/%00.env.1", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.1 HTTP\/1.1", "request_sample": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,appli", "payload_snippet": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "evidence": { "method": "GET", "path": "\/%00.env.1", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.1 HTTP\/1.1", "request_sample": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,appli", "payload_snippet": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a9a7987d485f7cf904222d4e3e30439c791a5b5a", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.1", "request_line": "GET \/%00.env.1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.1", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.1", "request_line": "GET \/%00.env.1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.1", "evidence_snippet": "GET \/%00.env.1 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.2	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.2 UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.2 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.2 Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.2 HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.2 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS Requête brute (extrait) GET /%00.env.2 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml,appli Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "2", "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "aafd7352fca3f4a3fac18cf57bfb3039d8d1261d", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 462, "payload_entropy": 5.497127450236386, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "4ae24216aa8951b9662d7141a51687621e292801", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729", "payload_hash": "9c0acb04d346cc7d6f580193dfb4b8dd", "path_pattern_hash": "c765710252277ae322b22af6091108d2" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "method": "GET", "path": "\/%00.env.2", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.2 HTTP\/1.1", "request_sample": "GET \/%00.env.2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,appli", "payload_snippet": "GET \/%00.env.2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "evidence": { "method": "GET", "path": "\/%00.env.2", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.2 HTTP\/1.1", "request_sample": "GET \/%00.env.2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,appli", "payload_snippet": "GET \/%00.env.2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7bae29320511b523b3125640a69620a32ca369bd", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.2", "request_line": "GET \/%00.env.2 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.2", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.2", "request_line": "GET \/%00.env.2 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.2", "evidence_snippet": "GET \/%00.env.2 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.export	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.export UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.export TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.export Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%00.env.export HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.export HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; W Requête brute (extrait) GET /%00.env.export HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0 Accept: text/html,application/xh Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "export", "http_ua_hash": "f5ae0e852d08c0a58b2510d7f2929df2ebee72d6", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "66f1d79bac9ed2398bea2cb5d56df2e32dd9b4cf", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 475, "payload_entropy": 5.487591039386035, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "3b20c356e5721a3b38548a5800bfb6829b3a23eb", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "817ecf5c09543bd892aad44157e9396f", "payload_hash": "2311ce924058ff7d0ce553c352b7156d", "path_pattern_hash": "1240c95a6145956b63f1f41a5ec38472" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.export HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "method": "GET", "path": "\/%00.env.export", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.export HTTP\/1.1", "request_sample": "GET \/%00.env.export HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xh", "payload_snippet": "GET \/%00.env.export HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "evidence": { "method": "GET", "path": "\/%00.env.export", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.export HTTP\/1.1", "request_sample": "GET \/%00.env.export HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131.0.0.0\r\nAccept: text\/html,application\/xh", "payload_snippet": "GET \/%00.env.export HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8e890c18f0f6a78245120f8977ce57cc07e665dd", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.export", "request_line": "GET \/%00.env.export HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.export HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.export", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.export", "request_line": "GET \/%00.env.export HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36 Edg\/131\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.export", "evidence_snippet": "GET \/%00.env.export HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 84 }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76.%64%61%74%61%62%61%73%65	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76.%64%61%74%61%62%61%73%65 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.%65%6e%76.%64%61%74%61%62%61%73%65 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76.%64%61%74%61%62%61%73%65 Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mo Requête brute (extrait) GET /.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%64%61%74%61%62%61%73%65", "http_ua_hash": "7b6f0c373feb98078719dc155349d959f98d35fe", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "9e01324d77d1f8910d47011ed809cc5cb4a52d30", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 490, "payload_entropy": 5.585493201909459, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "c7ed1233b7c6113fe8fe0bcf91a0b3dfb416fc51", "event_fingerprint": "c30f1e8fb4a59372c6b1083d65e528780440d4b3", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "e82f2e5be321b6f9c1cf4eb99bca6052", "payload_hash": "2d6ff3c642261e288adf4d328595fd78", "path_pattern_hash": "5234ed5347ed29f284226b4dfc34a1c4" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo", "method": "GET", "path": "\/.%65%6e%76.%64%61%74%61%62%61%73%65", "query_string": "v=NYW97", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html", "payload_snippet": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo", "evidence": { "method": "GET", "path": "\/.%65%6e%76.%64%61%74%61%62%61%73%65", "query_string": "v=NYW97", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html", "payload_snippet": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fa04b8dc01d936ecc15868f864882caa2bde57e8", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%64%61%74%61%62%61%73%65", "request_line": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%64%61%74%61%62%61%73%65", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%64%61%74%61%62%61%73%65", "request_line": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%64%61%74%61%62%61%73%65", "evidence_snippet": "GET \/.%65%6e%76.%64%61%74%61%62%61%73%65?v=NYW97 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mo", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.backup	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.backup UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.backup TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.backup Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.backup HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.backup HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel M Requête brute (extrait) GET /%00.env.backup HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml, Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "backup", "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "a7773aefeac7affd35763abd8395842dd2c9d9ed", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 467, "payload_entropy": 5.499818992608608, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "49e8d9837f9878739c66d81185c654fd6e839685", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729", "payload_hash": "083397a5fc65c5b284753aea6056b463", "path_pattern_hash": "fc692705551c051f18846870ca91c27c" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "method": "GET", "path": "\/%00.env.backup", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.backup HTTP\/1.1", "request_sample": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,", "payload_snippet": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "evidence": { "method": "GET", "path": "\/%00.env.backup", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.backup HTTP\/1.1", "request_sample": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,", "payload_snippet": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c3b0f4e8791f1b237b1703e191ffbc012462084a", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.backup", "request_line": "GET \/%00.env.backup HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.backup", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.backup", "request_line": "GET \/%00.env.backup HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.backup", "evidence_snippet": "GET \/%00.env.backup HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel M", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.encrypted	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.encrypted UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.encrypted TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.encrypted Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.encrypted HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.encrypted HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Inte Requête brute (extrait) GET /%00.env.encrypted HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+x Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "encrypted", "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "3a90faea4eee52ecf67cb447830845dbac6b56c1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 470, "payload_entropy": 5.488590260536619, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "3eaa396e07194b56ee1c2372d7426da6a10b133d", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729", "payload_hash": "2f4e0cbd53f41f40532ece81cfe6917e", "path_pattern_hash": "e03877f3c8f80005baeafda215c61501" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.encrypted HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte", "method": "GET", "path": "\/%00.env.encrypted", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.encrypted HTTP\/1.1", "request_sample": "GET \/%00.env.encrypted HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+x", "payload_snippet": "GET \/%00.env.encrypted HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte", "evidence": { "method": "GET", "path": "\/%00.env.encrypted", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.encrypted HTTP\/1.1", "request_sample": "GET \/%00.env.encrypted HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+x", "payload_snippet": "GET \/%00.env.encrypted HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "782fb216d80d9b7bf3df3010cbfe9affd2de4050", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.encrypted", "request_line": "GET \/%00.env.encrypted HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.encrypted HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.encrypted", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.encrypted", "request_line": "GET \/%00.env.encrypted HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.encrypted", "evidence_snippet": "GET \/%00.env.encrypted HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Inte", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.email	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.email UA Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.email TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.email Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.email HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.email HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64; Requête brute (extrait) GET /%00.env.email HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/; Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "email", "http_ua_hash": "11270158543935328f2909251018d45d4a0a7b49", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "b48969632a598277255ee3cf7e243ac5f1a758ee", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 419, "payload_entropy": 5.447901213423337, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "d3fc28021c722bc5c9f7e03ebf3e101cb9715c8e", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "4f03101ee384f6853bec3c7ae7111b36", "payload_hash": "cdad1a124873aaedc3ad7b06c4aa318c", "path_pattern_hash": "f51a1b6f9950bbc60e508d92547dd16e" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.email HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; ", "method": "GET", "path": "\/%00.env.email", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.email HTTP\/1.1", "request_sample": "GET \/%00.env.email HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,\/;", "payload_snippet": "GET \/%00.env.email HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;", "evidence": { "method": "GET", "path": "\/%00.env.email", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.email HTTP\/1.1", "request_sample": "GET \/%00.env.email HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,\/;", "payload_snippet": "GET \/%00.env.email HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7809bf67e256dd213329a32b30a132ea4d05bf85", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.email", "request_line": "GET \/%00.env.email HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.email HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.email", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.email", "request_line": "GET \/%00.env.email HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.email", "evidence_snippet": "GET \/%00.env.email HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.forge	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.forge UA Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) App… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.forge TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.forge Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%00.env.forge HTTP/1.1` User-Agent Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.forge HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; Requête brute (extrait) GET /%00.env.forge HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 Accept Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "forge", "http_ua_hash": "f1b0c5851a24119c3132019a305c1e659ab796c4", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "a5f5cdc9b0568734fe464f993a2bc22f0ecbe427", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 501, "payload_entropy": 5.550972440850025, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "842e75d58dc76b8416d31c9e9188ef9745405308", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9219a56a94233bae47f378d01e805eeb", "payload_hash": "126217a00e6a667d51e9f8948f9740c8", "path_pattern_hash": "feaeaa69c21b495febea479385fabfec" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.forge HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "method": "GET", "path": "\/%00.env.forge", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.forge HTTP\/1.1", "request_sample": "GET \/%00.env.forge HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept", "payload_snippet": "GET \/%00.env.forge HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "evidence": { "method": "GET", "path": "\/%00.env.forge", "user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.forge HTTP\/1.1", "request_sample": "GET \/%00.env.forge HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/60.0.3112.107 Moblie Safari\/537.36\r\nAccept", "payload_snippet": "GET \/%00.env.forge HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b99daa3e9bb105afb1a6f9cc66478478104d9852", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.forge", "request_line": "GET \/%00.env.forge HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.forge HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.forge", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.forge", "request_line": "GET \/%00.env.forge HTTP\/1.1", "http_user_agent": "Mozlila\/5.0 (Linux; Android 7.0; SM-G892A Bulid\/NRD90M; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/6\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.forge", "evidence_snippet": "GET \/%00.env.forge HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozlila\/5.0 (Linux; Android 7.0;", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76.%6d%61%73%74%65%72	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76.%6d%61%73%74%65%72 UA Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (K… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.%65%6e%76.%6d%61%73%74%65%72 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76.%6d%61%73%74%65%72 Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/ Requête brute (extrait) GET /.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 Accept: text/htm Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%6d%61%73%74%65%72", "http_ua_hash": "55065988985f443daa749697fa6791fe2d7c5661", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "8df5f4e727f1b87ea154d2f6b3759564958e9b30", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 491, "payload_entropy": 5.611223165425574, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "c7ed1233b7c6113fe8fe0bcf91a0b3dfb416fc51", "event_fingerprint": "80f77716055c598e52cae65867db1091c2be9399", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b6437c44634b78992a7fb87fd879dbec", "payload_hash": "9d287ec9623135552d10cc6e68aed811", "path_pattern_hash": "5a332f5eb85cff71b958c884f0709d6a" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/", "method": "GET", "path": "\/.%65%6e%76.%6d%61%73%74%65%72", "query_string": "v=NOJBo", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/htm", "payload_snippet": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/", "evidence": { "method": "GET", "path": "\/.%65%6e%76.%6d%61%73%74%65%72", "query_string": "v=NOJBo", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/htm", "payload_snippet": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "389d2986aa2098048747481f7c3944112ba5680d", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%6d%61%73%74%65%72", "request_line": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%6d%61%73%74%65%72", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%6d%61%73%74%65%72", "request_line": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-S928B) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Mobile Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%6d%61%73%74%65%72", "evidence_snippet": "GET \/.%65%6e%76.%6d%61%73%74%65%72?v=NOJBo HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.example	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.example UA Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWeb… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.example TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.example Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /%00.env.example HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.example HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhon Requête brute (extrait) GET /%00.env.example HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/605.1.15 Accept: text/html, Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "example", "http_ua_hash": "b3023841afdbe6d667109661e50fea57bc56a355", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "5608d421c7be1b0f797f6eb4fe816a8e437b2e78", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 489, "payload_entropy": 5.500106167798221, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "9f61c36c615a6bc3769b1bf6e8a5b2092b7606d2", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0d58ef81765da5a27ec97aa96204b01c", "payload_hash": "88d4589932d29068baf90f44e6ad3a64", "path_pattern_hash": "2253a2222985500eaab74807eef73d7e" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.example HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhon", "method": "GET", "path": "\/%00.env.example", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.example HTTP\/1.1", "request_sample": "GET \/%00.env.example HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,", "payload_snippet": "GET \/%00.env.example HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhon", "evidence": { "method": "GET", "path": "\/%00.env.example", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.example HTTP\/1.1", "request_sample": "GET \/%00.env.example HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E148 Safari\/605.1.15\r\nAccept: text\/html,", "payload_snippet": "GET \/%00.env.example HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhon", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d37b05f457e57d6972f47afb2ea6b05f5fd1eda", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.example", "request_line": "GET \/%00.env.example HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.example HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhon", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.example", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.example", "request_line": "GET \/%00.env.example HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Mobile\/15E\u2026", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.example", "evidence_snippet": "GET \/%00.env.example HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhon", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.aws	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.aws UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.aws TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.aws Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.aws HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.aws HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac Requête brute (extrait) GET /%00.env.aws HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15 Accept: text/html,application/xhtml+xml,app Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "aws", "http_ua_hash": "b0b2744b960d787378467e82a5e5342fec40cbf8", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "ae15d7ec2c6a27454d9c3d3219b828d13594788c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 464, "payload_entropy": 5.496801212410441, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "8eacffa6d4b0565267909361bdde954b4fb34e06", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "33e9ab573ab2f13bc268d70e6c261729", "payload_hash": "b8e7fab43384e2542ac874f5c0c71200", "path_pattern_hash": "bc1fa7330b785600c05ab3c9566e4cbf" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac ", "method": "GET", "path": "\/%00.env.aws", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.aws HTTP\/1.1", "request_sample": "GET \/%00.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,app", "payload_snippet": "GET \/%00.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "evidence": { "method": "GET", "path": "\/%00.env.aws", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.aws HTTP\/1.1", "request_sample": "GET \/%00.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15\r\nAccept: text\/html,application\/xhtml+xml,app", "payload_snippet": "GET \/%00.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3bc81c83b508ee719c12f2ae47fff10131a8fc2c", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.aws", "request_line": "GET \/%00.env.aws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.aws", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.aws", "request_line": "GET \/%00.env.aws HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/18.2 Safari\/605.1.15", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.aws", "evidence_snippet": "GET \/%00.env.aws HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.docker	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.docker UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.docker TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.docker Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.docker HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.docker HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; W Requête brute (extrait) GET /%00.env.docker HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,imag Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "docker", "http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "4ad8ca34dd3eaf37eb7b1fe896d5a9840a77029c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 430, "payload_entropy": 5.452322960144954, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "9dedb6d616f6c6765bd6501095e208cd89d954ed", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71", "payload_hash": "9112ebed1b281f76880aa9f1b58ad4ad", "path_pattern_hash": "f7735fbc3bcb62827e1b545e1e2cf41e" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.docker HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "method": "GET", "path": "\/%00.env.docker", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.docker HTTP\/1.1", "request_sample": "GET \/%00.env.docker HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,imag", "payload_snippet": "GET \/%00.env.docker HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "evidence": { "method": "GET", "path": "\/%00.env.docker", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.docker HTTP\/1.1", "request_sample": "GET \/%00.env.docker HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,imag", "payload_snippet": "GET \/%00.env.docker HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d5626a1fe2e7c921fff2e4d643b50ba89213368a", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.docker", "request_line": "GET \/%00.env.docker HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.docker HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.docker", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.docker", "request_line": "GET \/%00.env.docker HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.docker", "evidence_snippet": "GET \/%00.env.docker HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.4	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.4 UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.4 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.4 Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.4 HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.4 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS Requête brute (extrait) GET /%00.env.4 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,appli Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "4", "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "f77ab38ea3819d57c9e58d6247c55dae453fb5ad", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 462, "payload_entropy": 5.502865666121127, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "538780b757ff82ab742f47deea0cfe1461263c6c", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf", "payload_hash": "2cfc0d6423096c6293e7fccd51355ba1", "path_pattern_hash": "868c06a498fc2e6b7b61637d602f0b57" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "method": "GET", "path": "\/%00.env.4", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.4 HTTP\/1.1", "request_sample": "GET \/%00.env.4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli", "payload_snippet": "GET \/%00.env.4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "evidence": { "method": "GET", "path": "\/%00.env.4", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.4 HTTP\/1.1", "request_sample": "GET \/%00.env.4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,appli", "payload_snippet": "GET \/%00.env.4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e223c80c61249d69fbd32d3c7c3556f6ac337122", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.4", "request_line": "GET \/%00.env.4 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.4", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.4", "request_line": "GET \/%00.env.4 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.4", "evidence_snippet": "GET \/%00.env.4 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.credentials	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.credentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.credentials TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.credentials Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.credentials HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.credentials HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10 Requête brute (extrait) GET /%00.env.credentials HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "credentials", "http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "c59aed482725803c1300e7aa9c0707c1f0b93d01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 435, "payload_entropy": 5.436066757087371, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "fe1266b2766d29366fee6d0736bf8f5228cd6668", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71", "payload_hash": "6892b5977ec823974c7e856efb276cdf", "path_pattern_hash": "5f927f328c55221f7e795dc39c784da4" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10", "method": "GET", "path": "\/%00.env.credentials", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.credentials HTTP\/1.1", "request_sample": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp", "payload_snippet": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10", "evidence": { "method": "GET", "path": "\/%00.env.credentials", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.credentials HTTP\/1.1", "request_sample": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp", "payload_snippet": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ab663fc7db8b3dfbdaecf7d18d599821f5897f1e", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.credentials", "request_line": "GET \/%00.env.credentials HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.credentials", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.credentials", "request_line": "GET \/%00.env.credentials HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.credentials", "evidence_snippet": "GET \/%00.env.credentials HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.old	Élevée	Élevé · 68
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.old UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 950521:leak-8 Cible HTTP GET /%00.env.old TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.old Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Élevé · 68 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.old HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 leak-8 Payload (extrait) GET /%00.env.old HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac Requête brute (extrait) GET /%00.env.old HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,app Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "old", "http_ua_hash": "734b6ead759b479a4292aa92494c1177234bdcc9", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "7f4255fc8db88900c7f31c5c3e85fd207b582e5b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 464, "payload_entropy": 5.498224800122428, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 100, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 100, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 68, "tag_count": 6, "anomaly_count": 0, "campaign_key": "20999f6233c08115728c02cd27fc6c666488e827", "event_fingerprint": "1cdf689eac4648d4fbf9bd7755467ba5b66decf7", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 68 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "28e19718e8682b7b2da889b8120da9bf", "payload_hash": "de5b390c638e2c80dddcb40e7bed4345", "path_pattern_hash": "1500ac0b2cef49366bb3355f13b340c7" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 68 }, "payload_preview": "GET \/%00.env.old HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac ", "method": "GET", "path": "\/%00.env.old", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "950521:leak-8" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1", "leak-8" ], "request_line": "GET \/%00.env.old HTTP\/1.1", "request_sample": "GET \/%00.env.old HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app", "payload_snippet": "GET \/%00.env.old HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "evidence": { "method": "GET", "path": "\/%00.env.old", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "950521:leak-8" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1", "leak-8" ], "request_line": "GET \/%00.env.old HTTP\/1.1", "request_sample": "GET \/%00.env.old HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,app", "payload_snippet": "GET \/%00.env.old HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d1977eadc847683ed04e2d33db8d6e59336d0869", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.old", "request_line": "GET \/%00.env.old HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.old HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.old", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 80, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 68 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 68, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.old", "request_line": "GET \/%00.env.old HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.old", "evidence_snippet": "GET \/%00.env.old HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "950521:leak-8", "http_backup_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:12378 · (tentative d'exploit) · → /.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74 UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74 Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User- Requête brute (extrait) GET /.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html, Meta JSON brut { "http_header_count": 8, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": "%64%65%76%65%6c%6f%70%6d%65%6e%74", "http_ua_hash": "0f8259c88d67eef653c35e01343df82524cff242", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "d5fc7267983aaa66a304aa0e9414bdd1ea2ab79b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 489, "payload_entropy": 5.590306580194672, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "c7ed1233b7c6113fe8fe0bcf91a0b3dfb416fc51", "event_fingerprint": "1d62ac66a126e2e74347b5cf78ed365af43cc0b4", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c5b76ff6062b0afb2f75e5962e1e7278", "payload_hash": "8a6d13988c520dcbf3eb8f6f3be1b996", "path_pattern_hash": "cb6e9a451e7843a3ff2008631af40fbf" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-", "method": "GET", "path": "\/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74", "query_string": "v=wFy28", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,", "payload_snippet": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-", "evidence": { "method": "GET", "path": "\/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74", "query_string": "v=wFy28", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1", "request_sample": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36\r\nAccept: text\/html,", "payload_snippet": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b4f324e1128cde39353fe3a07043ecf80b271054", "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74", "request_line": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-", "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74", "request_line": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/131.0.0.0 Safari\/537.36", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74", "evidence_snippet": "GET \/.%65%6e%76.%64%65%76%65%6c%6f%70%6d%65%6e%74?v=wFy28 HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path", "net_flood" ], "asn_dc_heuristic": true }
21/07/2026 05:51:05 UTC	TCP	12378 · HTTP	http	Flood / DDoS http flood · via HTTP:12378 · (tentative d'exploit) · → /%00.env.db	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1499 TA0001 TA0002 Protocole GET /%00.env.db UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 net_flood Cible HTTP GET /%00.env.db TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 12378 Chemin / cible /%00.env.db Service HTTP Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1499 Technique MITRE T1499 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /%00.env.db HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /%00.env.db HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64 Requête brute (extrait) GET /%00.env.db HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:12378 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/ap Meta JSON brut { "http_header_count": 8, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "db", "http_ua_hash": "0e93fa4e6fa7128e3ad4ebc516d37c89c5d44ad6", "http_host_hash": "7c7c4dba74ead0a347f62a7f19d7ccdd7195b49a", "http_target_hash": "79ac4cd91f16840cf896c79717a7088e576dc101", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 426, "payload_entropy": 5.4602502353941285, "port_category": "registered", "org": "DigitalOcean, LLC", "service": "http", "app_proto": "http", "asn": 14061, "country": "SG", "dst_port": 12378, "risk_waf": 92, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 64, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b8f91de80f26a87abd6f8c7afd764347ef9e1b24", "event_fingerprint": "87ebeac2f7f18013ac1b382f954573957947f095", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 122, "precision_signals": [ "MITRE-T1499" ], "kb_rule_ids": [ "MITRE-T1499" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SG", "asn": 14061, "org": "DigitalOcean, LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "222bb92af5102d5110f0e2e9fad99c71", "payload_hash": "a8e1bc1795f1bb49f8dc9553af322d41", "path_pattern_hash": "2ae7fa0161a51594ca4537308f68a20d" }, "target_context": { "dst_port": 12378, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/%00.env.db HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64", "method": "GET", "path": "\/%00.env.db", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.db HTTP\/1.1", "request_sample": "GET \/%00.env.db HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/ap", "payload_snippet": "GET \/%00.env.db HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64", "evidence": { "method": "GET", "path": "\/%00.env.db", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/%00.env.db HTTP\/1.1", "request_sample": "GET \/%00.env.db HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/ap", "payload_snippet": "GET \/%00.env.db HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1499" ], "mitre": "T1499", "threat_family": [ "ddos" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fe95c78d93a37cde112e169647e29e9be5111126", "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.db", "request_line": "GET \/%00.env.db HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/%00.env.db HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64", "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.db", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 12378, "protocol_emulated": null, "tags_summary": [ "MITRE-T1499" ], "tags_summary_labels_fr": [ "MITRE-T1499" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1499", "mitre_technique": "T1499", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/%00.env.db", "request_line": "GET \/%00.env.db HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko\/20100101 Firefox\/134.0", "port": 12378, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http flood \u00b7 via HTTP:12378 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%00.env.db", "evidence_snippet": "GET \/%00.env.db HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:12378\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64", "target_port_label": "12378 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "12378" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "net_flood" ], "asn_dc_heuristic": true }

167.99.70.147

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence