Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941130
ES cat indices
Ligne de requête
GET /_cat/indices?format=json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Règles WAF
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?format=json HTTP/1.1
Host: 62.3.50.33:9200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) G
Requête brute (extrait)
GET /_cat/indices?format=json HTTP/1.1 Host: 62.3.50.33:9200 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Acce
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 11,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "645a13880dcb9457505909b589edb4ec45ef293f",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "370cae99942aa27e42f71117e2dde07013b646f5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 488,
"payload_entropy": 5.369661176777072,
"port_category": "registered",
"org": "TerraTransit AG",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 42366,
"country": "DE",
"dst_port": 9200,
"risk_waf": 100,
"risk_classification": 68,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25
},
"risk_score": 57,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "34d819fcbda94306efcad968f6c5b5f6a154c4ba",
"event_fingerprint": "215fef5602d81d0cd1ab4291d89cd82e15aaa3ba",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"pat-0284"
],
"kb_rule_ids": [
"pat-0284"
],
"matched_patterns": [
"pat-0284",
"pat-0342"
],
"matched_pattern_names": [
"CRS 941130",
"ES cat indices"
],
"pattern_ids": [
"pat-0284",
"pat-0342"
],
"confidence_breakdown": {
"waf": 100,
"classification": 68,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 57
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 42366,
"org": "TerraTransit AG",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ad4ca8ea7bc1709e8f7bb1ddff78c190",
"payload_hash": "bd10e3d3115d6982c2089be1db3607d2",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 57
},
"payload_preview": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) G",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAcce",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) G",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "format=json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?format=json HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\r\nAcce",
"payload_snippet": "GET \/_cat\/indices?format=json HTTP\/1.1\r\nHost: 62.3.50.33:9200\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) G",
"classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "008c78668577d950402e77ba2a1ae9ead7998bc1",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"net_elasticsearch_probe"
]
}
|