|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Traversal LFI
lfi path traversal · via ELASTICSEARCH:9200 · (tentative d'exploit)
|
Élevée
|
Moyen · 45
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / Requête Elasticsearch : / UA unitool-es/0.1
Émulateur
ELASTICSEARCH
WAF
11
Recommandation
Surveiller
Tags
950318:lfi-14
950734:sap-sapcontrol-path
net_elasticsearch_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9200
Chemin / cible
/
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 59 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
unitool-es/0.1
Règles WAF
lfi-14
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Accept-Encoding: identity
Host: 62.3.50.33:9200
User-Agent: unitool-es/0.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "22b7b8f31bce24a26169be58d3863396ba7a556e",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 115,
"payload_entropy": 4.848126765859551,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 50304,
"country": "FI",
"dst_port": 9200,
"risk_waf": 52,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 52,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2c571ee6f866f3ee8f20ae36d1d020f352a856cd",
"event_fingerprint": "8def331bfc01c7dad452979ec9172b64d8e4954c",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 52,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "elasticsearch",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "98c8bfa55fabd59dc52d16ddbb01b76b",
"payload_hash": "973a8e2194e5260c8722da962554fd34",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "unitool-es\/0.1",
"waf_tags": [
"950318:lfi-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "unitool-es\/0.1",
"waf_tags": [
"950318:lfi-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3940020c97c99e702bf53bc752b75abeb9cec0f8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "unitool-es\/0.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close",
"attack_vector": "lfi path traversal \u00b7 via ELASTICSEARCH:9200 \u00b7 (tentative d'exploit)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via ELASTICSEARCH \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 52,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "unitool-es\/0.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "lfi path traversal \u00b7 via ELASTICSEARCH:9200 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 52 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elasticsearch",
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950734:sap-sapcontrol-path",
"net_elasticsearch_probe"
]
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Sonde Elasticsearch (REST)
Émulateur
ELASTICSEARCH
WAF
—
Recommandation
Surveiller
Tags
elasticsearch_emulated
elasticsearch_tcp_probe
net_elasticsearch_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9200
Chemin / cible
—
Service
ELASTICSEARCH
Payload
� �Z+Ӽ�O�A8LcxD&���72K!�b�p�] 0�4M{�R��r*�'��`|� �<-�؈' "�,�0�+�/̨̩�$�(�#�' � � k g w�
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Z+Ӽ�O�A8LcxD&���72K!�b�p�] 0�4M{�R��r*�'��`|�
�<-�؈' "�,�0�+�/̨̩�$�(�#�' � � k g w�
Requête brute (extrait)
� �Z+Ӽ�O�A8LcxD&���72K!�b�p�] 0�4M{�R��r*�'��`|� �<-�؈' "�,�0�+�/̨̩�$�(�#�' � � k g w� � # http/1.1 1 6 4 + - 3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"bytes_in": 1515,
"payload_entropy": 7.727071402198756,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 50304,
"country": "FI",
"dst_port": 9200,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 33,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "93abadea2248805c510cdc75076bd41245b4474e",
"event_fingerprint": "64ce65412bf1b81fa23464b76dd480979155e3d0",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 8
},
"service_name": "elasticsearch",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "94c96a2788bebd3d5ee6257e65e8639b",
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z+\u04fc\ufffdO\ufffdA8LcxD&\ufffd\ufffd\ufffd7\u00132K!\ufffdb\ufffdp\u0016\ufffd\u0004] \u00050\ufffd4M{\ufffdR\ufffd\ufffdr*\ufffd'\ufffd\u0010\ufffd\u0002`|\ufffd\u0014\n\ufffd<-\ufffd\u0608\u0010'\u001f\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z+\u04fc\ufffdO\ufffdA8LcxD&\ufffd\ufffd\ufffd7\u00132K!\ufffdb\ufffdp\u0016\ufffd\u0004] \u00050\ufffd4M{\ufffdR\ufffd\ufffdr*\ufffd'\ufffd\u0010\ufffd\u0002`|\ufffd\u0014\n\ufffd<-\ufffd\u0608\u0010'\u001f\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u00006\u00004\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0004",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z+\u04fc\ufffdO\ufffdA8LcxD&\ufffd\ufffd\ufffd7\u00132K!\ufffdb\ufffdp\u0016\ufffd\u0004] \u00050\ufffd4M{\ufffdR\ufffd\ufffdr*\ufffd'\ufffd\u0010\ufffd\u0002`|\ufffd\u0014\n\ufffd<-\ufffd\u0608\u0010'\u001f\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a4ea5ad020834b61c33afc50e2b0e71f51f506eb",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z+\u04fc\ufffdO\ufffdA8LcxD&\ufffd\ufffd\ufffd7\u00132K!\ufffdb\ufffdp\u0016\ufffd\u0004] \u00050\ufffd4M{\ufffdR\ufffd\ufffdr*\ufffd'\ufffd\u0010\ufffd\u0002`|\ufffd\u0014\n\ufffd<-\ufffd\u0608\u0010'\u001f\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "\ufffd\ufffdZ+\u04fc\ufffdO\ufffdA8LcxD&\ufffd\ufffd\ufffd72K!\ufffdb\ufffdp\ufffd] 0\ufffd4M{\ufffdR\ufffd\ufffdr*\ufffd'\ufffd\ufffd`|\ufffd\n\ufffd<-\ufffd\u0608'\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgw\ufffd",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z+\u04fc\ufffdO\ufffdA8LcxD&\ufffd\ufffd\ufffd7\u00132K!\ufffdb\ufffdp\u0016\ufffd\u0004] \u00050\ufffd4M{\ufffdR\ufffd\ufffdr*\ufffd'\ufffd\u0010\ufffd\u0002`|\ufffd\u0014\n\ufffd<-\ufffd\u0608\u0010'\u001f\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdZ+\u04fc\ufffdO\ufffdA8LcxD&\ufffd\ufffd\ufffd72K!\ufffdb\ufffdp\ufffd] 0\ufffd4M{\ufffdR\ufffd\ufffdr*\ufffd'\ufffd\ufffd`|\ufffd\n\ufffd<-\ufffd\u0608'\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgw\ufffd",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elasticsearch",
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"elasticsearch_emulated",
"elasticsearch_tcp_probe",
"net_elasticsearch_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde PostgreSQL
postgres probe · via ELASTICSEARCH:9200 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9460af62ae0af667 Sonde Elasticsearch (REST)
Émulateur
ELASTICSEARCH
WAF
—
Recommandation
Surveiller
Tags
elasticsearch_emulated
elasticsearch_tcp_probe
net_elasticsearch_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9200
Chemin / cible
—
Service
ELASTICSEARCH
Payload
� �"��R֦u��s��Yo�P��H�x�H ��6�W` C�� /#�� �b�fXܴ��=iy�0 &�+�/�,�0̨̩� �� � � � / 5� { �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �"��R֦u��s��Yo�P��H�x�H ��6�W` C�� /#�� �b�fXܴ��=iy�0 &�+�/�,�0̨̩� ��
� � � / 5�
{ �
Requête brute (extrait)
� �"��R֦u��s��Yo�P��H�x�H ��6�W` C�� /#�� �b�fXܴ��=iy�0 &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ �[ro����zb I�!���J�[��� �6 e
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"bytes_in": 243,
"payload_entropy": 5.804949634799431,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 50304,
"country": "FI",
"dst_port": 9200,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "93abadea2248805c510cdc75076bd41245b4474e",
"event_fingerprint": "64ce65412bf1b81fa23464b76dd480979155e3d0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4d6d9a06412d0b369cebf913046dbe16",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "9460af62ae0af667130bf0d36514f084",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd\ufffdR\u0006\u05a6u\ufffd\ufffds\ufffd\ufffdYo\ufffdP\ufffd\ufffd\u0011H\ufffdx\ufffdH\u001f\ufffd\ufffd6\ufffdW` C\ufffd\ufffd\t\/\u0018#\ud892\ude71\ufffd\ufffd\t\ufffdb\u0004\ufffdf\u001bX\u0734\u0003\ufffd\ufffd=iy\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd\ufffdR\u0006\u05a6u\ufffd\ufffds\ufffd\ufffdYo\ufffdP\ufffd\ufffd\u0011H\ufffdx\ufffdH\u001f\ufffd\ufffd6\ufffdW` C\ufffd\ufffd\t\/\u0018#\ud892\ude71\ufffd\ufffd\t\ufffdb\u0004\ufffdf\u001bX\u0734\u0003\ufffd\ufffd=iy\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd[ro\ufffd\u001a\ufffd\ufffd\ufffd\u0014zb\u001cI\ufffd!\ufffd\ufffd\u0001\ufffdJ\ufffd[\ufffd\ufffd\ufffd\u001c\ufffd6\u001fe",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd\ufffdR\u0006\u05a6u\ufffd\ufffds\ufffd\ufffdYo\ufffdP\ufffd\ufffd\u0011H\ufffdx\ufffdH\u001f\ufffd\ufffd6\ufffdW` C\ufffd\ufffd\t\/\u0018#\ud892\ude71\ufffd\ufffd\t\ufffdb\u0004\ufffdf\u001bX\u0734\u0003\ufffd\ufffd=iy\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f91be08f69fe82e80d76e9e6e243d1ea5a03b0d4",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd\ufffdR\u0006\u05a6u\ufffd\ufffds\ufffd\ufffdYo\ufffdP\ufffd\ufffd\u0011H\ufffdx\ufffdH\u001f\ufffd\ufffd6\ufffdW` C\ufffd\ufffd\t\/\u0018#\ud892\ude71\ufffd\ufffd\t\ufffdb\u0004\ufffdf\u001bX\u0734\u0003\ufffd\ufffd=iy\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "\ufffd\ufffd\"\ufffd\ufffdR\u05a6u\ufffd\ufffds\ufffd\ufffdYo\ufffdP\ufffd\ufffdH\ufffdx\ufffdH\ufffd\ufffd6\ufffdW` C\ufffd\ufffd\t\/#\ud892\ude71\ufffd\ufffd\t\ufffdb\ufffdfX\u0734\ufffd\ufffd=iy\ufffd0&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{\ufffd",
"attack_vector": "postgres probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffd\ufffdR\u0006\u05a6u\ufffd\ufffds\ufffd\ufffdYo\ufffdP\ufffd\ufffd\u0011H\ufffdx\ufffdH\u001f\ufffd\ufffd6\ufffdW` C\ufffd\ufffd\t\/\u0018#\ud892\ude71\ufffd\ufffd\t\ufffdb\u0004\ufffdf\u001bX\u0734\u0003\ufffd\ufffd=iy\ufffd0\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "postgres probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\"\ufffd\ufffdR\u05a6u\ufffd\ufffds\ufffd\ufffdYo\ufffdP\ufffd\ufffdH\ufffdx\ufffdH\ufffd\ufffd6\ufffdW` C\ufffd\ufffd\t\/#\ud892\ude71\ufffd\ufffd\t\ufffdb\ufffdfX\u0734\ufffd\ufffd=iy\ufffd0&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{\ufffd",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elasticsearch",
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"elasticsearch_emulated",
"elasticsearch_tcp_probe",
"net_elasticsearch_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde PostgreSQL
postgres probe · via ELASTICSEARCH:9200 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9460af62ae0af667 Sonde Elasticsearch (REST)
Émulateur
ELASTICSEARCH
WAF
—
Recommandation
Surveiller
Tags
elasticsearch_emulated
elasticsearch_tcp_probe
net_elasticsearch_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9200
Chemin / cible
—
Service
ELASTICSEARCH
Payload
� ���U��7.J��W(�� ��B�m�� ��b��k�Ƴ?*H%���b st�x �Y�� &�+�/�,�0̨̩� �� � � � / 5� { �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���U��7.J��W(�� ��B�m�� ��b��k�Ƴ?*H%���b st�x �Y�� &�+�/�,�0̨̩� ��
� � � / 5�
{ �
Requête brute (extrait)
� ���U��7.J��W(�� ��B�m�� ��b��k�Ƴ?*H%���b st�x �Y�� &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ ��v<4`�)�䊌�d*��v��_���hB��
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"bytes_in": 243,
"payload_entropy": 5.7614336565893804,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 50304,
"country": "FI",
"dst_port": 9200,
"risk_waf": 8,
"risk_classification": 36,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "93abadea2248805c510cdc75076bd41245b4474e",
"event_fingerprint": "64ce65412bf1b81fa23464b76dd480979155e3d0",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8f2ce18dc45ea06dac6f9c4c7107a90b",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "9460af62ae0af667130bf0d36514f084",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 40
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\u0015\ufffd\u000e\ufffdU\ufffd\u0012\ufffd7\u0011.J\ufffd\u0012\ufffdW(\ufffd\ufffd\u0000\u0011\ufffd\ufffdB\ufffdm\ufffd\ufffd\u001f\u0007 \ufffd\u0013\ufffdb\ufffd\ufffdk\ufffd\u01b3\u0003\u000f?*\u0006H%\ufffd\ufffd\ufffdb\u0000st\ufffdx\u001f\ufffdY\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\u0015\ufffd\u000e\ufffdU\ufffd\u0012\ufffd7\u0011.J\ufffd\u0012\ufffdW(\ufffd\ufffd\u0000\u0011\ufffd\ufffdB\ufffdm\ufffd\ufffd\u001f\u0007 \ufffd\u0013\ufffdb\ufffd\ufffdk\ufffd\u01b3\u0003\u000f?*\u0006H%\ufffd\ufffd\ufffdb\u0000st\ufffdx\u001f\ufffdY\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0001\ufffd\ufffdv<4`\u000f\ufffd)\ufffd\u428c\ufffdd*\ufffd\ufffdv\u0007\ufffd\ufffd_\ufffd\ufffd\ufffdhB\ufffd\ufffd\u0019",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\u0015\ufffd\u000e\ufffdU\ufffd\u0012\ufffd7\u0011.J\ufffd\u0012\ufffdW(\ufffd\ufffd\u0000\u0011\ufffd\ufffdB\ufffdm\ufffd\ufffd\u001f\u0007 \ufffd\u0013\ufffdb\ufffd\ufffdk\ufffd\u01b3\u0003\u000f?*\u0006H%\ufffd\ufffd\ufffdb\u0000st\ufffdx\u001f\ufffdY\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f7d94a79fb805fbda8cbd4caa83805b8ca2b453",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\u0015\ufffd\u000e\ufffdU\ufffd\u0012\ufffd7\u0011.J\ufffd\u0012\ufffdW(\ufffd\ufffd\u0000\u0011\ufffd\ufffdB\ufffdm\ufffd\ufffd\u001f\u0007 \ufffd\u0013\ufffdb\ufffd\ufffdk\ufffd\u01b3\u0003\u000f?*\u0006H%\ufffd\ufffd\ufffdb\u0000st\ufffdx\u001f\ufffdY\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd7.J\ufffd\ufffdW(\ufffd\ufffd\ufffd\ufffdB\ufffdm\ufffd\ufffd \ufffd\ufffdb\ufffd\ufffdk\ufffd\u01b3?*H%\ufffd\ufffd\ufffdbst\ufffdx\ufffdY\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{\ufffd",
"attack_vector": "postgres probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 36,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\u0015\ufffd\u000e\ufffdU\ufffd\u0012\ufffd7\u0011.J\ufffd\u0012\ufffdW(\ufffd\ufffd\u0000\u0011\ufffd\ufffdB\ufffdm\ufffd\ufffd\u001f\u0007 \ufffd\u0013\ufffdb\ufffd\ufffdk\ufffd\u01b3\u0003\u000f?*\u0006H%\ufffd\ufffd\ufffdb\u0000st\ufffdx\u001f\ufffdY\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "postgres probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd7.J\ufffd\ufffdW(\ufffd\ufffd\ufffd\ufffdB\ufffdm\ufffd\ufffd \ufffd\ufffdb\ufffd\ufffdk\ufffd\u01b3?*H%\ufffd\ufffd\ufffdbst\ufffdx\ufffdY\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{\ufffd",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elasticsearch",
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"elasticsearch_emulated",
"elasticsearch_tcp_probe",
"net_elasticsearch_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
5601 · KIBANA
|
kibana
|
Sonde PostgreSQL
postgres probe · via KIBANA:5601 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9460af62ae0af667
Émulateur
KIBANA
WAF
—
Recommandation
Surveiller
Tags
kibana_emulated
net_kibana_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5601
Chemin / cible
—
Service
KIBANA
Payload
� �sD��a��.�M ����ޮy3y>i ,��5�� ŝ����I11b�, �D��[4��x��44~�0�� &�+�/�,�0̨̩� �� � � � / 5� { �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �sD��a��.�M
����ޮy3y>i ,��5�� ŝ����I11b�, �D��[4��x��44~�0�� &�+�/�,�0̨̩� ��
� � � / 5�
{ �
Requête brute (extrait)
� �sD��a��.�M ����ޮy3y>i ,��5�� ŝ����I11b�, �D��[4��x��44~�0�� &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ ��؎�̤4b�����!�6١����IN�ȴ��PD
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"bytes_in": 243,
"payload_entropy": 5.768169420271568,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "kibana",
"app_proto": "kibana",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "596002711a0eb0a4f35b7d18a0ad8be3baf85baf",
"event_fingerprint": "2e1f529c61b64068b719daaa760380b1c25ad6a1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "kibana",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c7c02e1357c74d8aab9540cb7ae6aefd",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "9460af62ae0af667130bf0d36514f084",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5601,
"service": "kibana",
"service_name": "kibana",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003sD\ufffd\ufffda\ufffd\ufffd.\ufffdM\n\ufffd\ufffd\u0016\ufffd\ufffd\u07aey3y>i\f,\ufffd\u0007\ufffd5\ufffd\u0017\ufffd \u015d\ufffd\ufffd\ufffd\u0015\ufffdI11b\ufffd,\u0000\ufffdD\ufffd\ufffd[4\ufffd\ufffdx\ufffd\ufffd44~\ufffd0\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003sD\ufffd\ufffda\ufffd\ufffd.\ufffdM\n\ufffd\ufffd\u0016\ufffd\ufffd\u07aey3y>i\f,\ufffd\u0007\ufffd5\ufffd\u0017\ufffd \u015d\ufffd\ufffd\ufffd\u0015\ufffdI11b\ufffd,\u0000\ufffdD\ufffd\ufffd[4\ufffd\ufffdx\ufffd\ufffd44~\ufffd0\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u060e\ufffd\u03244b\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd6\u0661\ufffd\ufffd\ufffd\ufffdIN\ufffd\u0234\ufffd\ufffdPD",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003sD\ufffd\ufffda\ufffd\ufffd.\ufffdM\n\ufffd\ufffd\u0016\ufffd\ufffd\u07aey3y>i\f,\ufffd\u0007\ufffd5\ufffd\u0017\ufffd \u015d\ufffd\ufffd\ufffd\u0015\ufffdI11b\ufffd,\u0000\ufffdD\ufffd\ufffd[4\ufffd\ufffdx\ufffd\ufffd44~\ufffd0\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b9ce67074006d888a49622356495af9cbe6c325",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003sD\ufffd\ufffda\ufffd\ufffd.\ufffdM\n\ufffd\ufffd\u0016\ufffd\ufffd\u07aey3y>i\f,\ufffd\u0007\ufffd5\ufffd\u0017\ufffd \u015d\ufffd\ufffd\ufffd\u0015\ufffdI11b\ufffd,\u0000\ufffdD\ufffd\ufffd[4\ufffd\ufffdx\ufffd\ufffd44~\ufffd0\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"evidence_snippet": "\ufffd\ufffdsD\ufffd\ufffda\ufffd\ufffd.\ufffdM\n\ufffd\ufffd\ufffd\ufffd\u07aey3y>i,\ufffd\ufffd5\ufffd\ufffd \u015d\ufffd\ufffd\ufffd\ufffdI11b\ufffd,\ufffdD\ufffd\ufffd[4\ufffd\ufffdx\ufffd\ufffd44~\ufffd0\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{\ufffd",
"attack_vector": "postgres probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kibana",
"service_label_fr": "KIBANA",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kibana",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003sD\ufffd\ufffda\ufffd\ufffd.\ufffdM\n\ufffd\ufffd\u0016\ufffd\ufffd\u07aey3y>i\f,\ufffd\u0007\ufffd5\ufffd\u0017\ufffd \u015d\ufffd\ufffd\ufffd\u0015\ufffdI11b\ufffd,\u0000\ufffdD\ufffd\ufffd[4\ufffd\ufffdx\ufffd\ufffd44~\ufffd0\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"attack_vector": "postgres probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdsD\ufffd\ufffda\ufffd\ufffd.\ufffdM\n\ufffd\ufffd\ufffd\ufffd\u07aey3y>i,\ufffd\ufffd5\ufffd\ufffd \u015d\ufffd\ufffd\ufffd\ufffdI11b\ufffd,\ufffdD\ufffd\ufffd[4\ufffd\ufffdx\ufffd\ufffd44~\ufffd0\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{\ufffd",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kibana",
"service_banner": "honeypot-kibana",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"kibana_emulated",
"net_kibana_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
5601 · KIBANA
|
kibana
|
Sonde PostgreSQL
postgres probe · via KIBANA:5601 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 9460af62ae0af667
Émulateur
KIBANA
WAF
—
Recommandation
Surveiller
Tags
kibana_emulated
net_kibana_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5601
Chemin / cible
—
Service
KIBANA
Payload
� �� �A��iq�$��;���#&<<�lBJ)�>W �si��n�ڜ�"G �ԕ�'��� A]}�$� &�+�/�,�0̨̩� �� � � � / 5� { �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �� �A��iq�$��;���#&<<�lBJ)�>W �si��n�ڜ�"G �ԕ�'���
A]}�$� &�+�/�,�0̨̩� ��
� � � / 5�
{ �
Requête brute (extrait)
� �� �A��iq�$��;���#&<<�lBJ)�>W �si��n�ڜ�"G �ԕ�'��� A]}�$� &�+�/�,�0̨̩� �� � � � / 5� { � + 3 & $ ��F��XrE�L*WlL ��s��� ���
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"bytes_in": 243,
"payload_entropy": 5.723833589483896,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "kibana",
"app_proto": "kibana",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "596002711a0eb0a4f35b7d18a0ad8be3baf85baf",
"event_fingerprint": "2e1f529c61b64068b719daaa760380b1c25ad6a1",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "kibana",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eae3bc1a99fafc0c59effe0fa4380fb8",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "9460af62ae0af667130bf0d36514f084",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"tls_version": "0x0303",
"tls_cipher_count": 19,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 5601,
"service": "kibana",
"service_name": "kibana",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0006\u0000\ufffdA\ufffd\u0001\ufffdiq\ufffd$\ufffd\u0011\ufffd;\ufffd\ufffd\u0017\ufffd#&<<\ufffdlBJ)\ufffd>W \ufffdsi\ufffd\ufffdn\u0015\ufffd\u069c\ufffd\"G\u001f\ufffd\u0515\ufffd'\ufffd\ufffd\ufffd\rA\u0019]}\u0003\u0014\ufffd$\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0006\u0000\ufffdA\ufffd\u0001\ufffdiq\ufffd$\ufffd\u0011\ufffd;\ufffd\ufffd\u0017\ufffd#&<<\ufffdlBJ)\ufffd>W \ufffdsi\ufffd\ufffdn\u0015\ufffd\u069c\ufffd\"G\u001f\ufffd\u0515\ufffd'\ufffd\ufffd\ufffd\rA\u0019]}\u0003\u0014\ufffd$\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0013F\ufffd\ufffdXrE\ufffdL*WlL\r\ufffd\ufffds\ufffd\u0016\ufffd\ufffd\t\u0004\u0003\ufffd\ufffd\u000f\ufffd\u0019",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0006\u0000\ufffdA\ufffd\u0001\ufffdiq\ufffd$\ufffd\u0011\ufffd;\ufffd\ufffd\u0017\ufffd#&<<\ufffdlBJ)\ufffd>W \ufffdsi\ufffd\ufffdn\u0015\ufffd\u069c\ufffd\"G\u001f\ufffd\u0515\ufffd'\ufffd\ufffd\ufffd\rA\u0019]}\u0003\u0014\ufffd$\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e2204172b3304459404bbb0070dc1e163e629eb9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0006\u0000\ufffdA\ufffd\u0001\ufffdiq\ufffd$\ufffd\u0011\ufffd;\ufffd\ufffd\u0017\ufffd#&<<\ufffdlBJ)\ufffd>W \ufffdsi\ufffd\ufffdn\u0015\ufffd\u069c\ufffd\"G\u001f\ufffd\u0515\ufffd'\ufffd\ufffd\ufffd\rA\u0019]}\u0003\u0014\ufffd$\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdiq\ufffd$\ufffd\ufffd;\ufffd\ufffd\ufffd#&<<\ufffdlBJ)\ufffd>W \ufffdsi\ufffd\ufffdn\ufffd\u069c\ufffd\"G\ufffd\u0515\ufffd'\ufffd\ufffd\ufffd\rA]}\ufffd$\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{\ufffd",
"attack_vector": "postgres probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kibana",
"service_label_fr": "KIBANA",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kibana",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0006\u0000\ufffdA\ufffd\u0001\ufffdiq\ufffd$\ufffd\u0011\ufffd;\ufffd\ufffd\u0017\ufffd#&<<\ufffdlBJ)\ufffd>W \ufffdsi\ufffd\ufffdn\u0015\ufffd\u069c\ufffd\"G\u001f\ufffd\u0515\ufffd'\ufffd\ufffd\ufffd\rA\u0019]}\u0003\u0014\ufffd$\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"tls_ja3": "9460af62ae0af667130bf0d36514f084",
"tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"attack_vector": "postgres probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffdiq\ufffd$\ufffd\ufffd;\ufffd\ufffd\ufffd#&<<\ufffdlBJ)\ufffd>W \ufffdsi\ufffd\ufffdn\ufffd\u069c\ufffd\"G\ufffd\u0515\ufffd'\ufffd\ufffd\ufffd\rA]}\ufffd$\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n{\ufffd",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kibana",
"service_banner": "honeypot-kibana",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"kibana_emulated",
"net_kibana_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Sonde Elasticsearch (REST)
Émulateur
ELASTICSEARCH
WAF
—
Recommandation
Surveiller
Tags
elasticsearch_emulated
net_elasticsearch_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9200
Chemin / cible
—
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 22
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 50304,
"country": "FI",
"dst_port": 9200,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 22,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "6dfec99b98d53481ee9b4cf1a1a54e12b0341ca9",
"event_fingerprint": "64ce65412bf1b81fa23464b76dd480979155e3d0",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 22,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "elasticsearch",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 22
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "191a0c390e0c8bb3045189c33e41a4f22e6ddf86",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 22,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 22,
"risk_label": "Faible",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elasticsearch",
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"elasticsearch_emulated",
"net_elasticsearch_probe"
]
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Traversal LFI
lfi path traversal · via ELASTICSEARCH:9200 · (tentative d'exploit) · → /_cat/indices
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /_cat/indices Requête Elasticsearch : /_cat/indices?v&s=docs.count UA unitool-es/0.1
Émulateur
ELASTICSEARCH
WAF
25
Recommandation
Investiguer
Tags
950318:lfi-14
950325:rce-0
950468:nosqli-3
950607:elastic-cat
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
9200
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 60
Confiance : Confiance 59 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ES cat indices
Ligne de requête
GET /_cat/indices?v&s=docs.count HTTP/1.1
User-Agent
unitool-es/0.1
Règles WAF
lfi-14
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?v&s=docs.count HTTP/1.1
Accept-Encoding: identity
Host: 62.3.50.33:9200
User-Agent: unitool-es/0.1
Connect
Requête brute (extrait)
GET /_cat/indices?v&s=docs.count HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:9200 User-Agent: unitool-es/0.1 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"http_header_count": 4,
"http_query_params": 2,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "22b7b8f31bce24a26169be58d3863396ba7a556e",
"http_host_hash": "d19a1b8472adabca1ee6e310101ca46b45ece34e",
"http_target_hash": "f22ae4c79f0519a1ebbb972c60b61b5acd84d6c1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 142,
"payload_entropy": 4.947081518117212,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 50304,
"country": "FI",
"dst_port": 9200,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 50,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25
},
"risk_score": 60,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "564546b830a8c06dba16ca5a255c07aecc220209",
"event_fingerprint": "be9de93d22af2c50196121227ba1f003ff355f48",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0342"
],
"matched_pattern_names": [
"ES cat indices"
],
"pattern_ids": [
"pat-0342"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "elasticsearch",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "98c8bfa55fabd59dc52d16ddbb01b76b",
"payload_hash": "95ad8f25e6f377cbce9f4a8310d71798",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 60
},
"payload_preview": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "v&s=docs.count",
"user_agent": "unitool-es\/0.1",
"waf_tags": [
"950318:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "v&s=docs.count",
"user_agent": "unitool-es\/0.1",
"waf_tags": [
"950318:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2cc7e1e9da2fc0fcf83169526cc87637ec0bea90",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1",
"http_user_agent": "unitool-es\/0.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?v&s=docs.count",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"attack_vector": "lfi path traversal \u00b7 via ELASTICSEARCH:9200 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_cat\/indices",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via ELASTICSEARCH \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 50,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1",
"http_user_agent": "unitool-es\/0.1",
"elasticsearch_probe_fr": "Requ\u00eate Elasticsearch : \/_cat\/indices?v&s=docs.count",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "lfi path traversal \u00b7 via ELASTICSEARCH:9200 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_cat\/indices",
"evidence_snippet": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:9200\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elasticsearch",
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"net_elasticsearch_probe"
]
}
|
|
|
TCP |
9200 · ELASTICSEARCH
|
elasticsearch
|
Sonde Elasticsearch
elasticsearch probe · via ELASTICSEARCH:9200 · (sonde / probe)
|
Élevée
|
Faible · 33
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Sonde Elasticsearch (REST)
Émulateur
ELASTICSEARCH
WAF
—
Recommandation
Surveiller
Tags
elasticsearch_emulated
elasticsearch_tcp_probe
net_elasticsearch_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9200
Chemin / cible
—
Service
ELASTICSEARCH
Payload
� ���G��g�x�r�9;I^ڪ|�M�sδ�06�f� �ӵ��]��2 �����JY�J�������ʅ�f "�,�0�+�/̨̩�$�(�#�' � � k g w�
Pourquoi cette classification : Type « elasticsearch_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 33
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���G��g�x�r�9;I^ڪ|�M�sδ�06�f� �ӵ��]��2 �����JY�J�������ʅ�f "�,�0�+�/̨̩�$�(�#�' � � k g w�
Requête brute (extrait)
� ���G��g�x�r�9;I^ڪ|�M�sδ�06�f� �ӵ��]��2 �����JY�J�������ʅ�f "�,�0�+�/̨̩�$�(�#�' � � k g w� � # http/1.1 1 6 4 + - 3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a582d656c61737469632d70726f647563743a20456c61737469637365617263680d0a436f6e74656e742d4c656e6774683a2034380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b22636c",
"emulator_response_len": 172,
"bytes_in": 1515,
"payload_entropy": 7.711902784706005,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "elasticsearch",
"app_proto": "elasticsearch",
"asn": 50304,
"country": "FI",
"dst_port": 9200,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 33,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "93abadea2248805c510cdc75076bd41245b4474e",
"event_fingerprint": "64ce65412bf1b81fa23464b76dd480979155e3d0",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 8
},
"service_name": "elasticsearch",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5b231d6a35f31b75dfc403e55bee365c",
"path_pattern_hash": "9dbf5366f59d9174076d704198d3d3fd"
},
"target_context": {
"dst_port": 9200,
"service": "elasticsearch",
"service_name": "elasticsearch",
"risk_score": 33
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0012\ufffdG\ufffd\ufffdg\ufffd\u0014x\ufffdr\ufffd9;I^\u06aa|\ufffdM\ufffds\u03b4\ufffd06\ufffdf\ufffd \ufffd\u04f5\ufffd\ufffd]\ufffd\ufffd2\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJY\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0285\ufffdf\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0012\ufffdG\ufffd\ufffdg\ufffd\u0014x\ufffdr\ufffd9;I^\u06aa|\ufffdM\ufffds\u03b4\ufffd06\ufffdf\ufffd \ufffd\u04f5\ufffd\ufffd]\ufffd\ufffd2\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJY\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0285\ufffdf\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u00006\u00004\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0004",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0012\ufffdG\ufffd\ufffdg\ufffd\u0014x\ufffdr\ufffd9;I^\u06aa|\ufffdM\ufffds\u03b4\ufffd06\ufffdf\ufffd \ufffd\u04f5\ufffd\ufffd]\ufffd\ufffd2\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJY\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0285\ufffdf\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f0ad4caad7e6e861d9c87424f5db78dd4a364e16",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0012\ufffdG\ufffd\ufffdg\ufffd\u0014x\ufffdr\ufffd9;I^\u06aa|\ufffdM\ufffds\u03b4\ufffd06\ufffdf\ufffd \ufffd\u04f5\ufffd\ufffd]\ufffd\ufffd2\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJY\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0285\ufffdf\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffdg\ufffdx\ufffdr\ufffd9;I^\u06aa|\ufffdM\ufffds\u03b4\ufffd06\ufffdf\ufffd \ufffd\u04f5\ufffd\ufffd]\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffdJY\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0285\ufffdf\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgw\ufffd",
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab elasticsearch_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 33,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 33,
"risk_label": "Faible",
"service_name": "elasticsearch",
"service_label_fr": "ELASTICSEARCH",
"dst_port": 9200,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "Elasticsearch 8.11",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"elasticsearch_probe_fr": "Sonde Elasticsearch (REST)",
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0012\ufffdG\ufffd\ufffdg\ufffd\u0014x\ufffdr\ufffd9;I^\u06aa|\ufffdM\ufffds\u03b4\ufffd06\ufffdf\ufffd \ufffd\u04f5\ufffd\ufffd]\ufffd\ufffd2\u0000\ufffd\ufffd\ufffd\ufffd\ufffdJY\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0285\ufffdf\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"port": 9200,
"service": "elasticsearch",
"service_label_fr": "ELASTICSEARCH"
},
"attack_vector": "elasticsearch probe \u00b7 via ELASTICSEARCH:9200 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffdg\ufffdx\ufffdr\ufffd9;I^\u06aa|\ufffdM\ufffds\u03b4\ufffd06\ufffdf\ufffd \ufffd\u04f5\ufffd\ufffd]\ufffd\ufffd2\ufffd\ufffd\ufffd\ufffd\ufffdJY\ufffdJ\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0285\ufffdf\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgw\ufffd",
"target_port_label": "9200 \u00b7 ELASTICSEARCH",
"emulator_service": "elasticsearch",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "elasticsearch",
"service_banner": "Elasticsearch 8.11",
"service_os": "linux",
"dst_port": "9200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"elasticsearch",
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"elasticsearch_emulated",
"elasticsearch_tcp_probe",
"net_elasticsearch_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
5601 · HTTP
|
http
|
Sonde port 5601/TCP
port 5601 tcp · via HTTP:5601 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA estk/0.0.1 (+https://github.com/LeakIX/estk)
Émulateur
HTTP
WAF
15
Recommandation
Surveiller
Tags
950406:ssrf-3
950470:nosqli-3
950734:sap-sapcontrol-path
http_ua_disclosed_scanner
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5601
Chemin / cible
/
Preuve honeypot — Sonde port 5601/TCP
Connexion détectée sur le port 5601 (TCP) du capteur simulé.
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 38
Confiance : Confiance 50 % — Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
estk/0.0.1 (+https://github.com/LeakIX/estk)
Règles WAF
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5601
User-Agent: estk/0.0.1 (+https://github.com/LeakIX/estk)
Accept: application/json
kbn-v
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: estk/0.0.1 (+https://github.com/LeakIX/estk) Accept: application/json kbn-version: kbn-xsrf: true Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "875a86105bbbbdc608faeb5ddbbd975303598599",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 198,
"payload_entropy": 5.145926829454253,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "http",
"app_proto": "http",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 37.5,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 37.5,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "c499c70c4dc647b2bb904e8050304156ff61a87d",
"event_fingerprint": "71c77abde47ab683cd76a23f6bcd66230f2b6a45",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 37.5,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 38,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "752e3196c844984505c26a05de210685",
"payload_hash": "ca8bf23960afb84b7a5a577cc00fdd97",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: application\/json\r\nkbn-v",
"method": "GET",
"path": "\/",
"user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"waf_tags": [
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: application\/json\r\nkbn-version: \r\nkbn-xsrf: true\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: application\/json\r\nkbn-v",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"waf_tags": [
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: application\/json\r\nkbn-version: \r\nkbn-xsrf: true\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: application\/json\r\nkbn-v",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d33e834358a4418c499e71ec0f16ac091c80535f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: application\/json\r\nkbn-v",
"attack_vector": "port 5601 tcp \u00b7 via HTTP:5601 \u00b7 (sonde \/ probe)",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 37.5,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 38,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 5601 tcp \u00b7 via HTTP:5601 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: application\/json\r\nkbn-v",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 37 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_ua_disclosed_scanner",
"net_web_probe"
]
}
|
|
|
TCP |
5601 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:5601 · (tentative d'exploit) · → /api/console/proxy
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/console/proxy UA estk/0.0.1 (+https://github.com/LeakIX/estk)
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950325:rce-0
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
POST
/api/console/proxy
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
5601
Chemin / cible
/api/console/proxy
Pourquoi cette classification : User-Agent scanner commercial déclaré · Sonde fichier sensible / config · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 60
Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
LFI Double-dot bypass
Ligne de requête
POST /api/console/proxy?method=GET&path=/ HTTP/1.1
User-Agent
estk/0.0.1 (+https://github.com/LeakIX/estk)
Règles WAF
rce-0
ssrf-3
nosqli-3
k8s-api
webshell-param-file
Payload (extrait)
POST /api/console/proxy?method=GET&path=/ HTTP/1.1
Host: 62.3.50.33:5601
User-Agent: estk/0.0.1 (+https://github.com/LeakIX/es
Requête brute (extrait)
POST /api/console/proxy?method=GET&path=/ HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: estk/0.0.1 (+https://github.com/LeakIX/estk) Content-Length: 0 Accept: application/json Content-Type: application/json kbn-version: kbn-xsrf: true Accept-Encoding
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 9,
"http_query_params": 2,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "875a86105bbbbdc608faeb5ddbbd975303598599",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "9ff9a086e5344d3a3db5b93ac89f236184fd09da",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.192854151073222,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "http",
"app_proto": "http",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 85,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 85,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 60,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "271fd785fe13d9d5205ec43a6142fe1836d51b2a",
"event_fingerprint": "e4dd246064e7b99a14e039f1ede6d9b41a159a4f",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0103"
],
"confidence_breakdown": {
"waf": 85,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "752e3196c844984505c26a05de210685",
"payload_hash": "51ec0740f5c3348e81f77279bfa06433",
"path_pattern_hash": "2257749ad5213b22dc528ffa1cca7545"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/es",
"method": "POST",
"path": "\/api\/console\/proxy",
"query_string": "method=GET&path=\/",
"user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"waf_tags": [
"950325:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"950630:webshell-param-file"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"k8s-api",
"webshell-param-file"
],
"request_line": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1",
"request_sample": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nContent-Length: 0\r\nAccept: application\/json\r\nContent-Type: application\/json\r\nkbn-version: \r\nkbn-xsrf: true\r\nAccept-Encoding",
"payload_snippet": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/es",
"evidence": {
"method": "POST",
"path": "\/api\/console\/proxy",
"query_string": "method=GET&path=\/",
"user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"waf_tags": [
"950325:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"950630:webshell-param-file"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3",
"k8s-api",
"webshell-param-file"
],
"request_line": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1",
"request_sample": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nContent-Length: 0\r\nAccept: application\/json\r\nContent-Type: application\/json\r\nkbn-version: \r\nkbn-xsrf: true\r\nAccept-Encoding",
"payload_snippet": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/es",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"disclosed_scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b90af21c0135dfdbf56ff0eddd35bb1cbf6384a",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/console\/proxy",
"request_line": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1",
"http_user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/es",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 95%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 85,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/console\/proxy",
"request_line": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1",
"http_user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy",
"evidence_snippet": "POST \/api\/console\/proxy?method=GET&path=\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/es",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 85 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"950630:webshell-param-file",
"http_probe_api",
"http_sensitive_path",
"http_suspicious_params",
"http_ua_disclosed_scanner",
"net_web_probe"
]
}
|
|
|
TCP |
5601 · HTTP
|
http
|
Sonde port 5601/TCP
port 5601 tcp · via HTTP:5601 · (sonde / probe) · → /elasticsearch/
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /elasticsearch/ UA estk/0.0.1 (+https://github.com/LeakIX/estk)
Émulateur
HTTP
WAF
18
Recommandation
Surveiller
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
http_probe_elasticsearch
Cible HTTP
GET
/elasticsearch/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5601
Chemin / cible
/elasticsearch/
Preuve honeypot — Sonde port 5601/TCP
Connexion détectée sur le port 5601 (TCP) du capteur simulé.
Pourquoi cette classification : User-Agent scanner commercial déclaré · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 38
Confiance : Confiance 50 % — Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /elasticsearch/ HTTP/1.1
User-Agent
estk/0.0.1 (+https://github.com/LeakIX/estk)
Règles WAF
ssrf-3
nosqli-3
Payload (extrait)
GET /elasticsearch/ HTTP/1.1
Host: 62.3.50.33:5601
User-Agent: estk/0.0.1 (+https://github.com/LeakIX/estk)
Accept: applicati
Requête brute (extrait)
GET /elasticsearch/ HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: estk/0.0.1 (+https://github.com/LeakIX/estk) Accept: application/json kbn-version: kbn-xsrf: true Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 7,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "875a86105bbbbdc608faeb5ddbbd975303598599",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "2a850e35674a27a5e52d30716055ded9de0f80e6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 212,
"payload_entropy": 5.130004945150472,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "http",
"app_proto": "http",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 45,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 45,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 38,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "e9a7a82f40b1a6282c744b4909bfcb8f43a1daf7",
"event_fingerprint": "e33ce2cd61fe74567c482c2c5a9ba5a32b9d9399",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 45,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 38,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "752e3196c844984505c26a05de210685",
"payload_hash": "8601f11deb2479129138a329a99e66fe",
"path_pattern_hash": "4d07efc1db9ce928ebcd17a3fef95c4d"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/elasticsearch\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: applicati",
"method": "GET",
"path": "\/elasticsearch\/",
"user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/elasticsearch\/ HTTP\/1.1",
"request_sample": "GET \/elasticsearch\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: application\/json\r\nkbn-version: \r\nkbn-xsrf: true\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/elasticsearch\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: applicati",
"evidence": {
"method": "GET",
"path": "\/elasticsearch\/",
"user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/elasticsearch\/ HTTP\/1.1",
"request_sample": "GET \/elasticsearch\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: application\/json\r\nkbn-version: \r\nkbn-xsrf: true\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/elasticsearch\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: applicati",
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a04b3fbd14a762f9b6e862b6917ccdc8b6fc67dc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/elasticsearch\/",
"request_line": "GET \/elasticsearch\/ HTTP\/1.1",
"http_user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/elasticsearch\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: applicati",
"attack_vector": "port 5601 tcp \u00b7 via HTTP:5601 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/elasticsearch\/",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"classification_reason_label_fr": "User-Agent scanner commercial d\u00e9clar\u00e9 \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 45,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 38,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/elasticsearch\/",
"request_line": "GET \/elasticsearch\/ HTTP\/1.1",
"http_user_agent": "estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 5601 tcp \u00b7 via HTTP:5601 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/elasticsearch\/",
"evidence_snippet": "GET \/elasticsearch\/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: estk\/0.0.1 (+https:\/\/github.com\/LeakIX\/estk)\r\nAccept: applicati",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 45 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_elasticsearch",
"http_ua_disclosed_scanner",
"net_web_probe"
]
}
|
|
|
TCP |
5601 · KIBANA
|
kibana
|
kibana probe
kibana probe · via KIBANA:5601 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KIBANA
WAF
—
Recommandation
Surveiller
Tags
kibana_emulated
net_kibana_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5601
Chemin / cible
—
Service
KIBANA
Payload
� ��B�kN:7��}�������|^�`��8�|7� -����,�X߅��H��B��z��x�f�B�- "�,�0�+�/̨̩�$�(�#�' � � k g w�
Pourquoi cette classification : Type « kibana_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��B�kN:7��}�������|^�`��8�|7� -����,�X߅��H��B��z��x�f�B�- "�,�0�+�/̨̩�$�(�#�' � � k g w�
Requête brute (extrait)
� ��B�kN:7��}�������|^�`��8�|7� -����,�X߅��H��B��z��x�f�B�- "�,�0�+�/̨̩�$�(�#�' � � k g w� � # http/1.1 1 6 4 + - 3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"bytes_in": 1515,
"payload_entropy": 7.72920873577021,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "kibana",
"app_proto": "kibana",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "596002711a0eb0a4f35b7d18a0ad8be3baf85baf",
"event_fingerprint": "2e1f529c61b64068b719daaa760380b1c25ad6a1",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "kibana",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0fe9dcbd51254f074c375d4eb5256701",
"path_pattern_hash": "0f790dc1ffcf37cb597b3d4bfc47e511"
},
"target_context": {
"dst_port": 5601,
"service": "kibana",
"service_name": "kibana",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\u0018\ufffdkN:7\u0001\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd|^\ufffd`\ufffd\ufffd8\ufffd|7\ufffd\u0003 -\ufffd\ufffd\ufffd\ufffd,\ufffdX\u07c5\ufffd\u0005\ufffdH\u0006\u0010\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffdx\ufffdf\ufffdB\ufffd-\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\u0018\ufffdkN:7\u0001\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd|^\ufffd`\ufffd\ufffd8\ufffd|7\ufffd\u0003 -\ufffd\ufffd\ufffd\ufffd,\ufffdX\u07c5\ufffd\u0005\ufffdH\u0006\u0010\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffdx\ufffdf\ufffdB\ufffd-\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u00006\u00004\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0004",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\u0018\ufffdkN:7\u0001\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd|^\ufffd`\ufffd\ufffd8\ufffd|7\ufffd\u0003 -\ufffd\ufffd\ufffd\ufffd,\ufffdX\u07c5\ufffd\u0005\ufffdH\u0006\u0010\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffdx\ufffdf\ufffdB\ufffd-\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1508d64bc6ce2501a46030248b336be1f6c478f6",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\u0018\ufffdkN:7\u0001\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd|^\ufffd`\ufffd\ufffd8\ufffd|7\ufffd\u0003 -\ufffd\ufffd\ufffd\ufffd,\ufffdX\u07c5\ufffd\u0005\ufffdH\u0006\u0010\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffdx\ufffdf\ufffdB\ufffd-\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"evidence_snippet": "\ufffd\ufffd\ufffdB\ufffdkN:7\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd|^\ufffd`\ufffd\ufffd8\ufffd|7\ufffd -\ufffd\ufffd\ufffd\ufffd,\ufffdX\u07c5\ufffd\ufffdH\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffdx\ufffdf\ufffdB\ufffd-\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgw\ufffd",
"attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kibana",
"service_label_fr": "KIBANA",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kibana",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\u0018\ufffdkN:7\u0001\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd|^\ufffd`\ufffd\ufffd8\ufffd|7\ufffd\u0003 -\ufffd\ufffd\ufffd\ufffd,\ufffdX\u07c5\ufffd\u0005\ufffdH\u0006\u0010\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffdx\ufffdf\ufffdB\ufffd-\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdB\ufffdkN:7\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd|^\ufffd`\ufffd\ufffd8\ufffd|7\ufffd -\ufffd\ufffd\ufffd\ufffd,\ufffdX\u07c5\ufffd\ufffdH\ufffd\ufffdB\ufffd\ufffdz\ufffd\ufffdx\ufffdf\ufffdB\ufffd-\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgw\ufffd",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kibana",
"service_banner": "honeypot-kibana",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"kibana_emulated",
"net_kibana_probe",
"tls_clienthello"
]
}
|
|
|
TCP |
5601 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:5601 · (tentative d'exploit)
|
Élevée
|
Moyen · 45
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA unitool-es/0.1
Émulateur
HTTP
WAF
11
Recommandation
Surveiller
Tags
950318:lfi-14
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5601
Chemin / cible
/
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 59 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
unitool-es/0.1
Règles WAF
lfi-14
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Accept-Encoding: identity
Host: 62.3.50.33:5601
User-Agent: unitool-es/0.1
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "22b7b8f31bce24a26169be58d3863396ba7a556e",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 115,
"payload_entropy": 4.830735461511724,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "http",
"app_proto": "http",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 52,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 52,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0039d852a6722a809f92ef7d5c65d5a4139ffde7",
"event_fingerprint": "d73132b13036d03be8ad7db6527e0694f86a0eef",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"confidence_breakdown": {
"waf": 52,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "98c8bfa55fabd59dc52d16ddbb01b76b",
"payload_hash": "10c1ea3c72f89e54b3505c074c19aebf",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "unitool-es\/0.1",
"waf_tags": [
"950318:lfi-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "unitool-es\/0.1",
"waf_tags": [
"950318:lfi-14",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-14",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94a99a2a9eec6208d306699bfb9e8e0164dbd3c4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "unitool-es\/0.1",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close",
"attack_vector": "lfi path traversal \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit)",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 52,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "unitool-es\/0.1",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 52 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950318:lfi-14",
"950734:sap-sapcontrol-path",
"net_web_probe"
]
}
|
|
|
TCP |
5601 · KIBANA
|
kibana
|
kibana probe
kibana probe · via KIBANA:5601 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KIBANA
WAF
—
Recommandation
Surveiller
Tags
kibana_emulated
net_kibana_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5601
Chemin / cible
—
Pourquoi cette classification : Type « kibana_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "kibana",
"app_proto": "kibana",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 24,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9b8c7063184af590e074e6367a10d303c5aaba60",
"event_fingerprint": "2e1f529c61b64068b719daaa760380b1c25ad6a1",
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "kibana",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "0f790dc1ffcf37cb597b3d4bfc47e511"
},
"target_context": {
"dst_port": 5601,
"service": "kibana",
"service_name": "kibana",
"risk_score": 24
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "49e0018bd203e5249266db0a881a3d5640577140",
"protocol_details": {
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "kibana",
"service_label_fr": "KIBANA",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kibana",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kibana",
"service_banner": "honeypot-kibana",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"kibana_emulated",
"net_kibana_probe"
]
}
|
|
|
TCP |
5601 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:5601 · (tentative d'exploit) · → /_cat/indices
|
Élevée
|
Moyen · 59
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /_cat/indices UA unitool-es/0.1
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950318:lfi-14
950325:rce-0
950468:nosqli-3
950607:elastic-cat
Cible HTTP
GET
/_cat/indices
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5601
Chemin / cible
/_cat/indices
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
67%
Corrélation +8
Risque capteur
Moyen
· 59
Confiance : Confiance 59 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ES cat indices
Ligne de requête
GET /_cat/indices?v&s=docs.count HTTP/1.1
User-Agent
unitool-es/0.1
Règles WAF
lfi-14
rce-0
nosqli-3
elastic-cat
Payload (extrait)
GET /_cat/indices?v&s=docs.count HTTP/1.1
Accept-Encoding: identity
Host: 62.3.50.33:5601
User-Agent: unitool-es/0.1
Connect
Requête brute (extrait)
GET /_cat/indices?v&s=docs.count HTTP/1.1 Accept-Encoding: identity Host: 62.3.50.33:5601 User-Agent: unitool-es/0.1 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 4,
"http_query_params": 2,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "22b7b8f31bce24a26169be58d3863396ba7a556e",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "f22ae4c79f0519a1ebbb972c60b61b5acd84d6c1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 142,
"payload_entropy": 4.932997011074957,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "http",
"app_proto": "http",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 59,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "d288d2f874519b6872112b64eaf0a0a95a5c034e",
"event_fingerprint": "613685eaa1f56a846de3e151be722141e775e3aa",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0342"
],
"matched_pattern_names": [
"ES cat indices"
],
"pattern_ids": [
"pat-0342"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "98c8bfa55fabd59dc52d16ddbb01b76b",
"payload_hash": "f1fc4521505b05db923891e0534f462f",
"path_pattern_hash": "a5425e010c1f4e25ebcaced2b0353923"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 59
},
"payload_preview": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "v&s=docs.count",
"user_agent": "unitool-es\/0.1",
"waf_tags": [
"950318:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"evidence": {
"method": "GET",
"path": "\/_cat\/indices",
"query_string": "v&s=docs.count",
"user_agent": "unitool-es\/0.1",
"waf_tags": [
"950318:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"950607:elastic-cat"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"elastic-cat"
],
"request_line": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1",
"request_sample": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bd18727953e70445c622081da95cb5bb5461b7af",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1",
"http_user_agent": "unitool-es\/0.1",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"attack_vector": "lfi path traversal \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_cat\/indices",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 59,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 59,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_cat\/indices",
"request_line": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1",
"http_user_agent": "unitool-es\/0.1",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_cat\/indices",
"evidence_snippet": "GET \/_cat\/indices?v&s=docs.count HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:5601\r\nUser-Agent: unitool-es\/0.1\r\nConnect",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"950607:elastic-cat",
"http_probe_elastic",
"net_web_probe"
]
}
|
|
|
TCP |
5601 · KIBANA
|
kibana
|
kibana probe
kibana probe · via KIBANA:5601 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KIBANA
WAF
—
Recommandation
Surveiller
Tags
kibana_emulated
net_kibana_probe
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5601
Chemin / cible
—
Service
KIBANA
Payload
� �d S���?� �. qY! X��_�-�� $�s���f������b6/wd� J�6 ��-v�0� "�,�0�+�/̨̩�$�(�#�' � � k g w�
Pourquoi cette classification : Type « kibana_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0771
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d S���?� �. qY! X��_�-�� $�s���f������b6/wd� J�6 ��-v�0� "�,�0�+�/̨̩�$�(�#�' � � k g w�
Requête brute (extrait)
� �d S���?� �. qY! X��_�-�� $�s���f������b6/wd� J�6 ��-v�0� "�,�0�+�/̨̩�$�(�#�' � � k g w� � # http/1.1 1 6 4 + - 3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"bytes_in": 1515,
"payload_entropy": 7.6942447773900655,
"port_category": "registered",
"org": "Blix Solutions AS",
"service": "kibana",
"app_proto": "kibana",
"asn": 50304,
"country": "FI",
"dst_port": 5601,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "596002711a0eb0a4f35b7d18a0ad8be3baf85baf",
"event_fingerprint": "2e1f529c61b64068b719daaa760380b1c25ad6a1",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0771"
],
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"service_name": "kibana",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FI",
"asn": 50304,
"org": "Blix Solutions AS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "781a4365ce63b9386141b41b6779870b",
"path_pattern_hash": "0f790dc1ffcf37cb597b3d4bfc47e511"
},
"target_context": {
"dst_port": 5601,
"service": "kibana",
"service_name": "kibana",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003d\u0000S\ufffd\ufffd\ufffd\u0006?\ufffd\f\ufffd.\f\u000fq\u0011\u000fY!\u001cX\ufffd\ufffd\u0004_\ufffd-\ufffd\u0011\ufffd\u0001\u0000 $\ufffds\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb6\/wd\ufffd J\ufffd6\u0000\ufffd\ufffd-v\ufffd\u00150\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003d\u0000S\ufffd\ufffd\ufffd\u0006?\ufffd\f\ufffd.\f\u000fq\u0011\u000fY!\u001cX\ufffd\ufffd\u0004_\ufffd-\ufffd\u0011\ufffd\u0001\u0000 $\ufffds\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb6\/wd\ufffd J\ufffd6\u0000\ufffd\ufffd-v\ufffd\u00150\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\u0012\u0000\u0010\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u00006\u00004\t\u0005\t\u0006\t\u0004\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\u001a\b\u001b\b\u001c\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0004",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003d\u0000S\ufffd\ufffd\ufffd\u0006?\ufffd\f\ufffd.\f\u000fq\u0011\u000fY!\u001cX\ufffd\ufffd\u0004_\ufffd-\ufffd\u0011\ufffd\u0001\u0000 $\ufffds\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb6\/wd\ufffd J\ufffd6\u0000\ufffd\ufffd-v\ufffd\u00150\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9db2b8c5b6c7c97b97b1736687bdfd963026965a",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003d\u0000S\ufffd\ufffd\ufffd\u0006?\ufffd\f\ufffd.\f\u000fq\u0011\u000fY!\u001cX\ufffd\ufffd\u0004_\ufffd-\ufffd\u0011\ufffd\u0001\u0000 $\ufffds\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb6\/wd\ufffd J\ufffd6\u0000\ufffd\ufffd-v\ufffd\u00150\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"evidence_snippet": "\ufffd\ufffddS\ufffd\ufffd\ufffd?\ufffd\ufffd.qY!X\ufffd\ufffd_\ufffd-\ufffd\ufffd $\ufffds\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb6\/wd\ufffd J\ufffd6\ufffd\ufffd-v\ufffd0\ufffd\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgw\ufffd",
"attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kibana",
"service_label_fr": "KIBANA",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0771"
],
"tags_summary_labels_fr": [
"pat-0771"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kibana",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003d\u0000S\ufffd\ufffd\ufffd\u0006?\ufffd\f\ufffd.\f\u000fq\u0011\u000fY!\u001cX\ufffd\ufffd\u0004_\ufffd-\ufffd\u0011\ufffd\u0001\u0000 $\ufffds\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb6\/wd\ufffd J\ufffd6\u0000\ufffd\ufffd-v\ufffd\u00150\ufffd\u0000\"\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0001\u0000\u0005w\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000",
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffddS\ufffd\ufffd\ufffd?\ufffd\ufffd.qY!X\ufffd\ufffd_\ufffd-\ufffd\ufffd $\ufffds\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdb6\/wd\ufffd J\ufffd6\ufffd\ufffd-v\ufffd0\ufffd\"\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkgw\ufffd",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kibana",
"service_banner": "honeypot-kibana",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"kibana_emulated",
"net_kibana_probe",
"tls_clienthello"
]
}
|