|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic c2FtdXJheTohUUFaQFdTWDNlZGM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 118,
"payload_entropy": 5.320671017162678,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f3251247862a0b7448443d6540e3f9a2",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2FtdXJheTohUUFaQFdTWDNlZGM=\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2FtdXJheTohUUFaQFdTWDNlZGM=\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2FtdXJheTohUUFaQFdTWDNlZGM=",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2FtdXJheTohUUFaQFdTWDNlZGM=\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2FtdXJheTohUUFaQFdTWDNlZGM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "15bd878213e9d6ec9171de24c56ce0f4aac66ad2",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2FtdXJheTohUUFaQFdTWDNlZGM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2FtdXJheTohUUFaQFdTWDNlZGM=",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic eWxwOnlscA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.101868264536325,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3cd398900e2899ece86860417ad6136f",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic eWxwOnlscA==\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic eWxwOnlscA==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic eWxwOnlscA==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic eWxwOnlscA==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic eWxwOnlscA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a08eacd13aa227f38eefd04a7d4262d35cb4560",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic eWxwOnlscA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic eWxwOnlscA==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.284204741760473,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f41efcd9a8cfd0ccf7f0e8b84858e84c",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "63fb56795835b05aae9f8ec9684d86588d8540cf",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic YW1hdmlzOlJvb3RAMTIz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.254377201716139,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fe6023257fb5bf509e66d24942f6b5e6",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YW1hdmlzOlJvb3RAMTIz\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YW1hdmlzOlJvb3RAMTIz\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YW1hdmlzOlJvb3RAMTIz",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YW1hdmlzOlJvb3RAMTIz\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YW1hdmlzOlJvb3RAMTIz",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4c168be93f8dd3a9321e50bc00ac2fc3c97ce0f9",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YW1hdmlzOlJvb3RAMTIz",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YW1hdmlzOlJvb3RAMTIz",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
hdfs probe
hdfs probe · via HDFS NAMENODE:8020 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Pourquoi cette classification : Type « hdfs_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9969ff5a371923a76157235da42e0cab5e13865a",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "504871b8907d47c47e0e5eef0ff043b4"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb4d6fbba09a665624cfe5a1940dafae7764d842",
"protocol_details": {
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "hdfs probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "hdfs probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 108,
"payload_entropy": 5.231171299617282,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e1b0343cfb32fc11836f752cc2449f46",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "36706e818358c00b115b68956977efb7dd3f1b17",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0NTY3ZA==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic YWRtaW46MTIzNDU2
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic YWRtaW46MTIzNDU2
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 106,
"payload_entropy": 5.139821102219197,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f85164af3e144c4db258d8059afc28a0",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2\r\n\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "035af74ee7b830a4cc3019d2ba2a88d767eda48f",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic cm9vdDpQNHNzdzByZA==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic cm9vdDpQNHNzdzByZA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 108,
"payload_entropy": 5.232095979896077,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "549410292d1b14eacdf423cea7b7824e",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZA==\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZA==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZA==",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZA==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZA==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a1372ca99f555cfbf031da7b16ae7ea23a8d2f06",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZA==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZA==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZA==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZA==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
hdfs probe
hdfs probe · via HDFS NAMENODE:8020 · (sonde / probe)
|
Élevée
|
Faible · 34
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Pourquoi cette classification : Type « hdfs_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 52,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9969ff5a371923a76157235da42e0cab5e13865a",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "504871b8907d47c47e0e5eef0ff043b4"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb4d6fbba09a665624cfe5a1940dafae7764d842",
"protocol_details": {
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "hdfs probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 52,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "hdfs probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic cm9vdDpwYXNzd29yZA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.2748105914894765,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b8d814fbb4677f7a54c308f9ccf635d1",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "520c2a33adffa442c303a0e50f12411495c41e17",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic YWRtaW46MTU5NzUz
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic YWRtaW46MTU5NzUz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 104,
"payload_entropy": 5.1118207574964645,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "38b5c16fb69428d1414d456ad88cce04",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9dcd96b1292f2c463c0e7cbf32a71977dc979437",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 5.267438396578094,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2a03addd233256cc2a9d089d7c9a6596",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e369e65cf7f1c6c94f27630e4d0798a52a89bb89",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 110,
"payload_entropy": 5.263616900792377,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d25e60968354caba162cd18a2d1f1346",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx\r\n\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8d552bf23c4c6d7b38c1e117cb0da1650e281673",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic dGVzdDp0ZXN0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.11824269102485,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c075b0d4ec9b7a913af7c24057604b9e",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8967bf3897dacb9abef1937644f97b0f3ec765ac",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 118,
"payload_entropy": 5.29817083045036,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "11737910f00a2194c2045095f73bc480",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==\r\n\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4577f34c2685d856b6c63f8c1acbc4296bcbe17f",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic cm9vdDohQCNhZG1pbjEyMw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 5.327058848175726,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f1eeb9352a47786a67f47821f23a0042",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDohQCNhZG1pbjEyMw==\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDohQCNhZG1pbjEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDohQCNhZG1pbjEyMw==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDohQCNhZG1pbjEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDohQCNhZG1pbjEyMw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b8596f073d133974a768bbe304542c4649ac705f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDohQCNhZG1pbjEyMw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDohQCNhZG1pbjEyMw==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic am9oOmhvbWU=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic am9oOmhvbWU=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 100,
"payload_entropy": 5.130693816003216,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "49a312cc97fcb52ceff10159f623ac45",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07b8ea0be885f6bade90325191e96e39e702b833",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic bW9udGVzOm1vbnRlcw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.298403937847282,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "83adef2fe1891cb553ec104e6ea245e6",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7516eb11c2474d25905b021f0a09942d15d6cfc4",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic bW9udGVzOm1vbnRlcw==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic bW9udGVzOm1vbnRlcw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 110,
"payload_entropy": 5.29235562314447,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7a19d97bc71c975f018fb195334eba2c",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==\r\n\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d9e50b0f8721092b40d1fa607963feb12ba009b6",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic dXNlcjAzOjEyMzQ1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.134958949386529,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "084d54bbc748f6b45430bc36cd0de89a",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e4908745a66a74c83a59a2e517d8f4172872ed18",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic cm9vdDpwYXNzd29yZA==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic cm9vdDpwYXNzd29yZA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 110,
"payload_entropy": 5.2691912467204425,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e410119cfcc02cf2329979b91c4eb4ca",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==\r\n\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0354256b6893c3f6949ceb94536d501f072cae71",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZA==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic dXM1Om1hc3Rlcg==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 104,
"payload_entropy": 5.149100055030945,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "70a226abea328595cce347d016ec1147",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa1662f6a7a4cb94c2621ea8d81dbb4adf56de9b",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 114,
"payload_entropy": 5.267438396578094,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2a03addd233256cc2a9d089d7c9a6596",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=\r\n\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b8ea6f984aea54814238c6a2133d419f4f04cb9b",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dnBuOlBhJCR3MHJkMTIzNDU=",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.2691330169331145,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "07ff00edfcb708a7de4da58210755902",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b7ead92ee7ad8b924e0d56d91f27b525fc029ca6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZDYx",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXM1Om1hc3Rlcg==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic dXM1Om1hc3Rlcg==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 106,
"payload_entropy": 5.144622813439341,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c2c9ad533a2cbf83a3b3e4aa034ad8fd",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==\r\n\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e0d66cb4ebcaa2d5e1eced377879f8db78610392",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXM1Om1hc3Rlcg==",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic ODAwMDo4MDAw
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.032070073568053,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9fbb4af7407709e8d5179c5a99c1207a",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f9b0c8c5bd80ce7ab89b311e5ae95558850831c1",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic dXNlcjAzOjEyMzQ1
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic dXNlcjAzOjEyMzQ1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 106,
"payload_entropy": 5.130748521108972,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cf15e637810a85a4eeca9af2e2807b1e",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1\r\n\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "04ee9d667940b961851d37edc68e070d08a6bafc",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjAzOjEyMzQ1",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 118,
"payload_entropy": 5.29817083045036,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "11737910f00a2194c2045095f73bc480",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2195a7f6ea725fef300e8f3d84a62608396b8d9f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic c2Z0cHVzZXI6bnV0YW5peC80dQ==",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 35,
"payload_entropy": 4.114718016821338,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2497abaf97a20697197eadf8a6e41f27",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "26c2b4e8f0301feb8113f0141a4a1dd2b213cae2",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic am9oOmhvbWU=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.130693816003216,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "49a312cc97fcb52ceff10159f623ac45",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "467ea5d7ac290dfff956c24af1d570f7344ba52b",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic am9oOmhvbWU=",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8020 · HDFS NAMENODE
|
hdfs-namenode
|
Flood / DDoS
http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HDFS-NAMENODE
WAF
—
Recommandation
Surveiller
Tags
hdfs_namenode_emulated
hdfs_namenode_payload
net_hdfs_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8020
Chemin / cible
—
Service
HDFS NAMENODE
Payload
CONNECT 185.242.3.121:80 HTTP/1.0 Host: 185.242.3.121:80 Proxy-Authorization: Basic ODAwMDo4MDAw
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic ODAwMDo4MDAw
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
"emulator_response_len": 144,
"bytes_in": 102,
"payload_entropy": 5.032070073568053,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "hdfs-namenode",
"app_proto": "hdfs-namenode",
"asn": 401626,
"country": "NL",
"dst_port": 8020,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
"event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "hdfs-namenode",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9fbb4af7407709e8d5179c5a99c1207a",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8020,
"service": "hdfs-namenode",
"service_name": "hdfs-namenode",
"risk_score": 46
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"evidence": {
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "038a5f3d4aeecf6e9277b8bbd3d597537776b8df",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE",
"dst_port": 8020,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-hdfs-namenode",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"port": 8020,
"service": "hdfs-namenode",
"service_label_fr": "HDFS NAMENODE"
},
"attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw",
"target_port_label": "8020 \u00b7 HDFS NAMENODE",
"emulator_service": "hdfs-namenode",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "hdfs_namenode",
"service_banner": "honeypot-hdfs-namenode",
"service_os": "linux",
"dst_port": "8020"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"hdfs-namenode",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"hdfs_namenode_emulated",
"hdfs_namenode_payload",
"net_hdfs_probe"
]
}
|
|
|
TCP |
8090 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8090
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic YWRtaW46MTU5NzUz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.108046898877211,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8090,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
"event_fingerprint": "21f16f971c47f8bb4155c3665520eaaeacc9804c",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "256c5c88850ad99ecf5f46668ce50bcf",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c22c8c52d42c597d31f1b50e711ff1e6232b2c8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic YWRtaW46MTU5NzUz",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8889 · SPLUNK HEC
|
splunk-hec
|
splunk-hec
splunk-hec · via SPLUNK HEC:8889 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SPLUNK-HEC
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8889
Chemin / cible
—
Pourquoi cette classification : Type « splunk-hec » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "splunk-hec",
"app_proto": "splunk-hec",
"asn": 401626,
"country": "NL",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "b14acd2a8dc0382bfe05a3c819a0ec2a86f38315",
"event_fingerprint": "714a7f33a66a9fd197795d3501d25b4e27e582d3",
"classification_reason": "Type \u00ab splunk-hec \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "splunk-hec",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "d465d01b5922f4732130a3af79309a94"
},
"target_context": {
"dst_port": 8889,
"service": "splunk-hec",
"service_name": "splunk-hec",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "841a47586b72c058e68d6154f46376eb451784d4",
"protocol_details": {
"port": 8889,
"service": "splunk-hec",
"service_label_fr": "SPLUNK HEC"
},
"attack_vector": "splunk-hec \u00b7 via SPLUNK HEC:8889 \u00b7 (sonde \/ probe)",
"target_port_label": "8889 \u00b7 SPLUNK HEC",
"emulator_service": "splunk-hec",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk-hec \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab splunk-hec \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "splunk-hec",
"service_label_fr": "SPLUNK HEC",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk-hec",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8889,
"service": "splunk-hec",
"service_label_fr": "SPLUNK HEC"
},
"attack_vector": "splunk-hec \u00b7 via SPLUNK HEC:8889 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8889 \u00b7 SPLUNK HEC",
"emulator_service": "splunk-hec",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk_hec",
"service_banner": "honeypot-splunk-hec",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic MTox
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 92,
"payload_entropy": 4.916969973743707,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "e97b5fa0a497627977d9c76f148696a3f476702e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "210850c639a1d4694b4cdd4a402cbeb0",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "acdb7d2c4653bd747f5d5fa586326d92c91cc0a6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTox",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic cm9vdDoyMDI2aGFwcHl0dWdzYmFrZXJ5MjAyNg==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 130,
"payload_entropy": 5.495617837367829,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "e97b5fa0a497627977d9c76f148696a3f476702e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "adde510ff49b5dcb0e3fb8ddc1760328",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoyMDI2aGFwcHl0dWdzYmFrZXJ5MjAyNg==\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoyMDI2aGFwcHl0dWdzYmFrZXJ5MjAyNg==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoyMDI2aGFwcHl0dWdzYmFrZXJ5MjAyNg==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoyMDI2aGFwcHl0dWdzYmFrZXJ5MjAyNg==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoyMDI2aGFwcHl0dWdzYmFrZXJ5MjAyNg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ce1fab027c618e37db033ece96c3b622b4aa7bc8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoyMDI2aGFwcHl0dWdzYmFrZXJ5MjAyNg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic cm9vdDoyMDI2aGFwcHl0dWdzYmFrZXJ5MjAyNg==",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic MTExOjExMQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.062652578261815,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "e97b5fa0a497627977d9c76f148696a3f476702e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8c2eefba6462f3e506647b0b6b36ee65",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTExOjExMQ==\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTExOjExMQ==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTExOjExMQ==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTExOjExMQ==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTExOjExMQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba59fc08009b7ec08dd6f19b0e4197219cf4838a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTExOjExMQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic MTExOjExMQ==",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.265906021140552,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "e97b5fa0a497627977d9c76f148696a3f476702e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3ca2198ba7f968bd3a47bc398cc39aba",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "91c1ede5369a280bd2cc32919be45c8282aea9d6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bWFzdGVyOm1hc3Rlcg==",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic bW9udGVzOm1vbnRlcw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.29235562314447,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "e97b5fa0a497627977d9c76f148696a3f476702e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7a19d97bc71c975f018fb195334eba2c",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d20a5e0aa3538a6c62e8f6745a7dc6e3cbe31690",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic bW9udGVzOm1vbnRlcw==",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 185.242.3.121:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 185.242.3.121:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
185.242.3.121:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
185.242.3.121:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 185.242.3.121:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 185.242.3.121:80 HTTP/1.0
Host: 185.242.3.121:80
Proxy-Authorization: Basic dXNlcjox
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "121:80",
"http_ua_hash": null,
"http_host_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_target_hash": "cdd2f27c7d2c5eb6128398baf96535a261e3ce38",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 5.024847983168025,
"port_category": "registered",
"org": "Netiface America, Inc.",
"service": "http",
"app_proto": "http",
"asn": 401626,
"country": "NL",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "e97b5fa0a497627977d9c76f148696a3f476702e",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 401626,
"org": "Netiface America, Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "29ab9baf14a82b98b0f09d8c338955f4",
"path_pattern_hash": "2bdf19dd815942f2077cf0cae4eed7a5"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjox\r\n\r\n",
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjox\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjox",
"evidence": {
"method": "CONNECT",
"path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"request_sample": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjox\r\n\r\n",
"payload_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjox",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f11c4a362598a7de88664e38dc5ac25c9498cc11",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjox",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "185.242.3.121:80",
"request_line": "CONNECT 185.242.3.121:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 185.242.3.121:80",
"evidence_snippet": "CONNECT 185.242.3.121:80 HTTP\/1.0\r\nHost: 185.242.3.121:80\r\nProxy-Authorization: Basic dXNlcjox",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
|