Renseignement sur les menaces

Singapour

193.8.186.29

FAI PebbleHost Ltd Première vue 10/05/2026 04:09 UTC Dernière vue 16/06/2026 02:14 UTC Risque Critique

Période analysée : 2026-05-21 → 2026-06-20

Activité suspecte — risque 46/100 (Moyen) — MITRE TA0001 — confiance 59 % — via HTTP

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

100

Critique · Risque max (7j) Critique

Synthèse exécutive

Profil de menace

Score de risque 100/100 Critique

Première observation 10/05/2026 04:09 UTC

Dernière observation 16/06/2026 02:14 UTC

Événements (période) 148

MITRE ATT&CK principal TA0001 10 occurrences

Activité suspecte — risque 46/100 (Moyen) — MITRE TA0001 — confiance 59 % — via HTTP

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « xss_attack » (signaux protocolaires) · confiance 59%

Confiance 59 % — Score WAF 72 · 3 tag(s) WAF

Comparaison ASN / FAI

ASN 201002 · 193.8.186.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 148 événements sur la période pour cette IP.

194.164.96.171 Sonde SIP/VoIP 20/06/2026 19:10 UTC
193.8.186.31 pharos 16/06/2026 00:28 UTC
81.16.177.200 web attack 31/05/2026 19:14 UTC
194.213.3.117 Sonde port 13/05/2026 19:56 UTC
193.8.186.33 web attack 10/05/2026 05:59 UTC
193.8.186.35 web attack 10/05/2026 04:18 UTC
193.8.186.37 web attack 10/05/2026 03:44 UTC
85.11.182.21 web attack 18/02/2026 11:37 UTC

Événements (filtres)

148

Première observation

10/05/2026 04:09 UTC

Dernière observation

16/06/2026 02:14 UTC

Dernière activité (filtres)

16/06/2026 02:14 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 73 TLS TCP 68 K8S API TCP 2 HTTPS TCP 2 ORACLE EM TCP 1 HTTP ALT 8082 TCP 1 HTTP ALT 8088 TCP 1

HTTP

TLS

K8S API

HTTPS

ORACLE EM

HTTP ALT 8082

Géolocalisation

Origine réseau déclarée

Singapour unknown unknown

FAI / réseau

Opérateur et dernière activité ban

PebbleHost Ltd 330 Port 8080 xss_attack

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

xss attack · via HTTP:8080 · (tentative d'exploit)

Détails protocole

Méthode: GET
Chemin: /
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 S…

Aperçu payload

GET / HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec

Port / service

8080 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0284

Confiance

59%

Famille de menace

unknown

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

148 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

148 événement(s) — page 1/3

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
16/06/2026 02:14:08 UTC	TCP	8080 · HTTP	http	Cross-site scripting xss attack · via HTTP:8080 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.447336620236348, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "dst_port": 8080, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 4, "anomaly_count": 0, "campaign_key": "075e5345953235ea967a2535172cf98d1d3d388a", "event_fingerprint": "c4a5ea58b3d2b0d9f787b32d70530d766cc70177", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "e9d80f1fc5c84a7f5538397e262028c7", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "10b51d16c77036346cc05747677f2177206cb435", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit)", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
16/06/2026 01:44:38 UTC	TCP	8088 · HTTP ALT 8088	http-alt-8088	http-alt-8088 http-alt-8088 · via HTTP ALT 8088:8088 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8088 WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8088 Chemin / cible — Service HTTP ALT 8088 Payload �\�]�`��j�p�� $�@z��'s0�̩g�2D ��<[Sy�`.��9�8}/��L�ބ�kJ�pd#\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « http-alt-8088 » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �\�]�`��j�p�� $�@z��'s0�̩g�2D ��<[Sy�`.��9�8}/��L�ބ�kJ�pd#\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �\�]�`��j�p�� $�@z��'s0�̩g�2D ��<[Sy�`.��9�8}/��L�ބ�kJ�pd#\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 4.322437066685061, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http-alt-8088", "app_proto": "http-alt-8088", "asn": 201002, "country": "SG", "dst_port": 8088, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "c6a5539a7fac0faf399c0a215ac9450c24753038", "event_fingerprint": "e4439b80d6e4b371d582e64e67ce8ed1e436ce25", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab http-alt-8088 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "http-alt-8088", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e740ddf12c1f307d35c7c4a6200131db", "path_pattern_hash": "f7ffc7733123826391689a4267b358d2" }, "target_context": { "dst_port": 8088, "service": "http-alt-8088", "service_name": "http-alt-8088", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffd]\ufffd`\ufffd\ufffd\ufffdj\ufffdp\ufffd\ufffd\n$\ufffd@z\ufffd\u0005\ufffd's0\ufffd\u0329g\ufffd2D\u0019 \ufffd\ufffd\ufffd\u0010<[Sy\ufffd`.\ufffd\ufffd\u00039\ufffd8}\/\ufffd\ufffdL\ufffd\u0784\ufffdkJ\ufffdpd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffd]\ufffd`\ufffd\ufffd\ufffdj\ufffdp\ufffd\ufffd\n$\ufffd@z\ufffd\u0005\ufffd's0\ufffd\u0329g\ufffd2D\u0019 \ufffd\ufffd\ufffd\u0010<[Sy\ufffd`.\ufffd\ufffd\u00039\ufffd8}\/\ufffd\ufffdL\ufffd\u0784\ufffdkJ\ufffdpd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffd]\ufffd`\ufffd\ufffd\ufffdj\ufffdp\ufffd\ufffd\n$\ufffd@z\ufffd\u0005\ufffd's0\ufffd\u0329g\ufffd2D\u0019 \ufffd\ufffd\ufffd\u0010<[Sy\ufffd`.\ufffd\ufffd\u00039\ufffd8}\/\ufffd\ufffdL\ufffd\u0784\ufffdkJ\ufffdpd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab http-alt-8088 \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d6a0d32381504a35bfb9d00baee13dfd7cd6d051", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffd]\ufffd`\ufffd\ufffd\ufffdj\ufffdp\ufffd\ufffd\n$\ufffd@z\ufffd\u0005\ufffd's0\ufffd\u0329g\ufffd2D\u0019 \ufffd\ufffd\ufffd\u0010<[Sy\ufffd`.\ufffd\ufffd\u00039\ufffd8}\/\ufffd\ufffdL\ufffd\u0784\ufffdkJ\ufffdpd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 8088, "service": "http-alt-8088", "service_label_fr": "HTTP ALT 8088" }, "evidence_snippet": "\ufffd\\\ufffd]\ufffd`\ufffd\ufffd\ufffdj\ufffdp\ufffd\ufffd\n$\ufffd@z\ufffd\ufffd's0\ufffd\u0329g\ufffd2D \ufffd\ufffd\ufffd<[Sy\ufffd`.\ufffd\ufffd9\ufffd8}\/\ufffd\ufffdL\ufffd\u0784\ufffdkJ\ufffdpd#\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "http-alt-8088 \u00b7 via HTTP ALT 8088:8088 \u00b7 (sonde \/ probe)", "target_port_label": "8088 \u00b7 HTTP ALT 8088", "emulator_service": "http-alt-8088", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-8088 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab http-alt-8088 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "http-alt-8088", "service_label_fr": "HTTP ALT 8088", "dst_port": 8088, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8088", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\\\ufffd]\ufffd`\ufffd\ufffd\ufffdj\ufffdp\ufffd\ufffd\n$\ufffd@z\ufffd\u0005\ufffd's0\ufffd\u0329g\ufffd2D\u0019 \ufffd\ufffd\ufffd\u0010<[Sy\ufffd`.\ufffd\ufffd\u00039\ufffd8}\/\ufffd\ufffdL\ufffd\u0784\ufffdkJ\ufffdpd#\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 8088, "service": "http-alt-8088", "service_label_fr": "HTTP ALT 8088" }, "attack_vector": "http-alt-8088 \u00b7 via HTTP ALT 8088:8088 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\\\ufffd]\ufffd`\ufffd\ufffd\ufffdj\ufffdp\ufffd\ufffd\n$\ufffd@z\ufffd\ufffd's0\ufffd\u0329g\ufffd2D \ufffd\ufffd\ufffd<[Sy\ufffd`.\ufffd\ufffd9\ufffd8}\/\ufffd\ufffdL\ufffd\u0784\ufffdkJ\ufffdpd#\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "8088 \u00b7 HTTP ALT 8088", "emulator_service": "http-alt-8088", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8088", "service_banner": "honeypot-http-alt-8088", "service_os": "linux", "dst_port": "8088" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
16/06/2026 01:44:38 UTC	TCP	8088 · HTTP	http	Cross-site scripting xss attack · via HTTP:8088 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8088 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8088 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8088 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "5af561107125d8ccc4aac442a3b8b5dee6769a85", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.452229201878291, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "dst_port": 8088, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 47, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ae56f860171955f2b288985a500c23cee42d529f", "event_fingerprint": "37d96fce8f60b477529ee3ee20f66ccf08b6b641", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "36e32357944a52ef0d1cfc0493f0923e", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8088, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "be990b42e36a3a66b338b41a81e41a1d3d8d926d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8088, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8088 \u00b7 (tentative d'exploit)", "target_port_label": "8088 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8088, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8088, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8088 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8088\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8088 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8088" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8088" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
16/06/2026 00:11:04 UTC	TCP	6443 · K8S API	k8s-api	Sonde Kubernetes API kubernetes probe · via K8S API:6443 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur K8S-API WAF — Recommandation Surveiller Tags k8s_api_emulated k8s_api_payload kubernetes_probe net_kubernetes_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6443 Chemin / cible — Service K8S API Payload �� Q�$��9q�ٮ��nHp��K�m�ce z�z+��R�<��;&;5��GR�kSC-\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « kubernetes_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �� Q�$��9q�ٮ��nHp��K�m�ce z�z+��R�<��;&;5��GR�kSC-\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �� Q�$��9q�ٮ��nHp��K�m�ce z�z+��R�<��;&;5��GR�kSC-\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "15030300020228", "emulator_response_len": 7, "bytes_in": 517, "payload_entropy": 4.306204835487288, "port_category": "registered", "org": "PebbleHost Ltd", "service": "k8s-api", "app_proto": "k8s-api", "asn": 201002, "country": "SG", "dst_port": 6443, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 10, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 10 }, "risk_score": 35, "tag_count": 5, "anomaly_count": 0, "campaign_key": "5f70a73a5934201c2e00970f23615f0b69d2ca8a", "event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 10, "risk_score": 35 }, "service_name": "k8s-api", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b2fd6e8dae817c0c4fd6f3de2fda3bbf", "path_pattern_hash": "9911336c7fd1406c8e284bedc6c69f4b" }, "target_context": { "dst_port": 6443, "service": "k8s-api", "service_name": "k8s-api", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017\ufffd\u0018\tQ\ufffd$\ufffd\ufffd\u0002\ufffd9q\ufffd\u066e\ufffd\ufffdnHp\ufffd\ufffd\u0001K\ufffdm\ufffdce\u0003 z\ufffdz+\ufffd\ufffd\ufffdR\ufffd<\ufffd\ufffd;&;5\ufffd\ufffd\u0011\ufffd\ufffdGR\ufffdkSC\u0013-\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017\ufffd\u0018\tQ\ufffd$\ufffd\ufffd\u0002\ufffd9q\ufffd\u066e\ufffd\ufffdnHp\ufffd\ufffd\u0001K\ufffdm\ufffdce\u0003 z\ufffdz+\ufffd\ufffd\ufffdR\ufffd<\ufffd\ufffd;&;5\ufffd\ufffd\u0011\ufffd\ufffdGR\ufffdkSC\u0013-\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017\ufffd\u0018\tQ\ufffd$\ufffd\ufffd\u0002\ufffd9q\ufffd\u066e\ufffd\ufffdnHp\ufffd\ufffd\u0001K\ufffdm\ufffdce\u0003 z\ufffdz+\ufffd\ufffd\ufffdR\ufffd<\ufffd\ufffd;&;5\ufffd\ufffd\u0011\ufffd\ufffdGR\ufffdkSC\u0013-\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2670307797d2c6b0446c9c2317c6ab5b18f9ddb9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017\ufffd\u0018\tQ\ufffd$\ufffd\ufffd\u0002\ufffd9q\ufffd\u066e\ufffd\ufffdnHp\ufffd\ufffd\u0001K\ufffdm\ufffdce\u0003 z\ufffdz+\ufffd\ufffd\ufffdR\ufffd<\ufffd\ufffd;&;5\ufffd\ufffd\u0011\ufffd\ufffdGR\ufffdkSC\u0013-\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 6443, "service": "k8s-api", "service_label_fr": "K8S API" }, "evidence_snippet": "\ufffd\ufffd\ufffd\tQ\ufffd$\ufffd\ufffd\ufffd9q\ufffd\u066e\ufffd\ufffdnHp\ufffd\ufffdK\ufffdm\ufffdce z\ufffdz+\ufffd\ufffd\ufffdR\ufffd<\ufffd\ufffd;&;5\ufffd\ufffd\ufffd\ufffdGR\ufffdkSC-\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)", "target_port_label": "6443 \u00b7 K8S API", "emulator_service": "k8s-api", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 10, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "k8s-api", "service_label_fr": "K8S API", "dst_port": 6443, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-k8s-api", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0017\ufffd\u0018\tQ\ufffd$\ufffd\ufffd\u0002\ufffd9q\ufffd\u066e\ufffd\ufffdnHp\ufffd\ufffd\u0001K\ufffdm\ufffdce\u0003 z\ufffdz+\ufffd\ufffd\ufffdR\ufffd<\ufffd\ufffd;&;5\ufffd\ufffd\u0011\ufffd\ufffdGR\ufffdkSC\u0013-\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 6443, "service": "k8s-api", "service_label_fr": "K8S API" }, "attack_vector": "kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\tQ\ufffd$\ufffd\ufffd\ufffd9q\ufffd\u066e\ufffd\ufffdnHp\ufffd\ufffdK\ufffdm\ufffdce z\ufffdz+\ufffd\ufffd\ufffdR\ufffd<\ufffd\ufffd;*&;5\ufffd\ufffd\ufffd\ufffdGR\ufffdkSC-\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "6443 \u00b7 K8S API", "emulator_service": "k8s-api", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "k8s_api", "service_banner": "honeypot-k8s-api", "service_os": "linux", "dst_port": "6443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "k8s_api_emulated", "k8s_api_payload", "kubernetes_probe", "net_kubernetes_probe", "tls_clienthello" ] }
16/06/2026 00:11:04 UTC	TCP	6443 · K8S API	k8s-api	Cross-site scripting xss attack · via K8S API:6443 · (tentative d'exploit)	Élevée	Moyen · 47
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur K8S-API WAF — Recommandation Surveiller Tags http_get_probe k8s_api_emulated k8s_api_payload kubernetes_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6443 Chemin / cible — Service K8S API Payload GET / HTTP/1.1 Host: 62.3.50.33:6443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 47 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:6443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e312034303320466f7262696464656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2038370d0a0d0a7b226b696e64223a22537461747573222c2261706956657273696f6e223a227631222c22737461747573223a224661696c75", "emulator_response_len": 165, "bytes_in": 399, "payload_entropy": 5.446720314189158, "port_category": "registered", "org": "PebbleHost Ltd", "service": "k8s-api", "app_proto": "k8s-api", "asn": 201002, "country": "SG", "dst_port": 6443, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 6.3, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 47, "tag_count": 6, "anomaly_count": 0, "campaign_key": "ef86356910d7f7cdd52447d2d53697ca6a0c79fa", "event_fingerprint": "5535c85e0f6854b807e5b9ef895f87dbea310cc1", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 47 }, "named_classification_skipped": false, "service_name": "k8s-api", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "23cb895cb663ac2e9ec16c9ea67aa36d", "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300" }, "target_context": { "dst_port": 6443, "service": "k8s-api", "service_name": "k8s-api", "risk_score": 47 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b18c2945284636ce85c116cd397fe28021dd6e6f", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 6443, "service": "k8s-api", "service_label_fr": "K8S API" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via K8S API:6443 \u00b7 (tentative d'exploit)", "target_port_label": "6443 \u00b7 K8S API", "emulator_service": "k8s-api", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via K8S API", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 47 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 47, "risk_label": "Moyen", "service_name": "k8s-api", "service_label_fr": "K8S API", "dst_port": 6443, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-k8s-api", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 6443, "service": "k8s-api", "service_label_fr": "K8S API" }, "attack_vector": "xss attack \u00b7 via K8S API:6443 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "6443 \u00b7 K8S API", "emulator_service": "k8s-api", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "k8s_api", "service_banner": "honeypot-k8s-api", "service_os": "linux", "dst_port": "6443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "k8s_api_emulated", "k8s_api_payload", "kubernetes_probe", "mozi_pattern", "net_kubernetes_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
15/06/2026 23:33:18 UTC	TCP	8888 · HTTP	http	Cross-site scripting xss attack · via HTTP:8888 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8888 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF HTTP alt 8888 probe Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8888 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8888 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.455929767925268, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "dst_port": 8888, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 4, "anomaly_count": 0, "campaign_key": "e11c1b827d438ca6f81f14ef35ff35f7c31ff992", "event_fingerprint": "d96673c00b57d970f6555d6dff66c77e09351a74", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324", "pat-0599" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF", "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0284", "pat-0324", "pat-0599" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "4a0161278cf172e56a0f795473aade45", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "164c70d4d935a6700dd02433f253425292c12e5d", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
15/06/2026 21:26:20 UTC	TCP	11443 · TLS	tls	Sonde TLS tls probe · via TLS:11443 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 11443 Chemin / cible — Service TLS Payload ��Z�g�)��y� �K��/�pL� �CEd�+�wr�K@BA�j:,��A�:\|Q§\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��Z�g�)��y� �K��/�pL� �CEd�+�wr�K@BA�j:,��A�:\|Q§\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��Z�g�)��y� �K��/�pL� �CEd�+�wr�K@BA�j:,��A�:\|Q§\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.300320006257645, "port_category": "registered", "org": "PebbleHost Ltd", "service": "tls", "app_proto": "tls", "asn": 201002, "country": "SG", "dst_port": 11443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d7ec2422c6e6f404ff801e8ea89fcd8f78d1e50e", "event_fingerprint": "46c66d60d11bbd5dc29a9ac47fb8406df5265876", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "5702ef57528da8aa18fca76b80bf77d5", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 11443, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\ue372\ufffdZ\ufffdg\ufffd)\ufffd\u0013\ufffd\ufffd\ufffd\ufffdy\ufffd\n\ufffdK\ufffd\ufffd\/\u001c\ufffdpL\ufffd\u0013 \ufffdCEd\u001a\ufffd+\ufffdwr\u0017\ufffdK@BA\ufffdj:,\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd:\|Q\u00a7\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\ue372\ufffdZ\ufffdg\ufffd)\ufffd\u0013\ufffd\ufffd\ufffd\ufffdy\ufffd\n\ufffdK\ufffd\ufffd\/\u001c\ufffdpL\ufffd\u0013 \ufffdCEd\u001a\ufffd+\ufffdwr\u0017\ufffdK@BA\ufffdj:,\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd:\|Q\u00a7\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\ue372\ufffdZ\ufffdg\ufffd)\ufffd\u0013\ufffd\ufffd\ufffd\ufffdy\ufffd\n\ufffdK\ufffd\ufffd\/\u001c\ufffdpL\ufffd\u0013 \ufffdCEd\u001a\ufffd+\ufffdwr\u0017\ufffdK@BA\ufffdj:,\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd:\|Q\u00a7\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2f34fd015219fe42950ea3c19a6d406964badf7b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\ue372\ufffdZ\ufffdg\ufffd)\ufffd\u0013\ufffd\ufffd\ufffd\ufffdy\ufffd\n\ufffdK\ufffd\ufffd\/\u001c\ufffdpL\ufffd\u0013 \ufffdCEd\u001a\ufffd+\ufffdwr\u0017\ufffdK@BA\ufffdj:,\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd:\|Q\u00a7\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 11443, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ue372\ufffdZ\ufffdg\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\n\ufffdK\ufffd\ufffd\/\ufffdpL\ufffd \ufffdCEd\ufffd+\ufffdwr\ufffdK@BA\ufffdj:,\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd:\|Q\u00a7\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:11443 \u00b7 (sonde \/ probe)", "target_port_label": "11443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 11443, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\ue372\ufffdZ\ufffdg\ufffd)\ufffd\u0013\ufffd\ufffd\ufffd\ufffdy\ufffd\n\ufffdK\ufffd\ufffd\/\u001c\ufffdpL\ufffd\u0013 \ufffdCEd\u001a\ufffd+\ufffdwr\u0017\ufffdK@BA\ufffdj:,\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd:\|Q\u00a7\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 11443, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:11443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ue372\ufffdZ\ufffdg\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\n\ufffdK\ufffd\ufffd\/\ufffdpL\ufffd \ufffdCEd\ufffd+\ufffdwr\ufffdK@BA\ufffdj:,\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd:\|Q\u00a7\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "11443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "11443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
15/06/2026 21:26:20 UTC	TCP	11443 · HTTP	http	Cross-site scripting xss attack · via HTTP:11443 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11443 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "9ef1b6d504b654fe06cbbf3870a4ee75ac65add6", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.449291278110535, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "dst_port": 11443, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 3, "anomaly_count": 0, "campaign_key": "98b2bfc6793250eb5bf4cf995e9dc72f6cc95cdf", "event_fingerprint": "e04724e45b8eae444ca56cf066854b80def6f78c", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "65f02a927b267868985c2b37f7073e32", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 11443, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2421d4171c3d53aabb851f34eeb63c8a11fdb8bf", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 11443, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via HTTP:11443 \u00b7 (tentative d'exploit)", "target_port_label": "11443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 11443, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 11443, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:11443 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "11443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "11443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
15/06/2026 18:23:27 UTC	TCP	10443 · HTTPS	https	minecraft probe minecraft probe · via HTTPS:10443 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10443 Chemin / cible — Service HTTPS Payload ��Y��ԗ�OU��.�}]�l��^��� �x�5�{�W��+��B�SV�g�f��k\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « minecraft_probe » (signaux protocolaires) · confiance 42% Confiance classification 42% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 42 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Y��ԗ�OU��.�}]�l��^��� �x�5�{�W��+��B�SV�g�f��k\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��Y��ԗ�OU��.�}]�l��^��� �x�5�{�W��+��B�SV�g�f��k\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 4.3361101290120345, "port_category": "registered", "org": "PebbleHost Ltd", "service": "https", "app_proto": "https", "asn": 201002, "country": "SG", "dst_port": 10443, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 0 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "bf82ed4958219b6801f74213ab3f101ded76679b", "event_fingerprint": "0ce879e35222bcf244eb8071cb051f2e9c4aa580", "classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%", "confidence": 0.42, "classification_confidence": 0.42, "precision_score": 50, "precision_signals": [ "pat-0554" ], "kb_rule_ids": [ "pat-0554" ], "matched_patterns": [ "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 0, "risk_score": 45 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 42, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "77856d1f4bd9bcbe6058bc6495e981e0", "path_pattern_hash": "796c509ff0514fcb64ff9e5a1c4b51db" }, "target_context": { "dst_port": 10443, "service": "https", "service_name": "https", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdY\ufffd\ufffd\u0517\ufffdOU\ufffd\ufffd\u0018.\ufffd}]\ufffdl\ufffd\ufffd\ufffd^\u0013\ufffd\ufffd\u0017\ufffd \ufffdx\ufffd\ue17b5\ufffd{\ufffdW\ufffd\u0016\ufffd\ufffd+\ufffd\ufffd\ufffdB\ufffdSV\ufffdg\ufffdf\ufffd\ufffd\ufffd\ufffdk\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdY\ufffd\ufffd\u0517\ufffdOU\ufffd\ufffd\u0018.\ufffd}]\ufffdl\ufffd\ufffd\ufffd^\u0013\ufffd\ufffd\u0017\ufffd \ufffdx\ufffd\ue17b5\ufffd{\ufffdW\ufffd\u0016\ufffd\ufffd+\ufffd\ufffd\ufffdB\ufffdSV\ufffdg\ufffdf\ufffd\ufffd\ufffd\ufffdk\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdY\ufffd\ufffd\u0517\ufffdOU\ufffd\ufffd\u0018.\ufffd}]\ufffdl\ufffd\ufffd\ufffd^\u0013\ufffd\ufffd\u0017\ufffd \ufffdx\ufffd\ue17b5\ufffd{\ufffdW\ufffd\u0016\ufffd\ufffd+\ufffd\ufffd\ufffdB\ufffdSV\ufffdg\ufffdf\ufffd\ufffd\ufffd\ufffdk\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "game_server_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "df52c3dcb3bab9f48b512b1a9373b9ae756c77fa", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdY\ufffd\ufffd\u0517\ufffdOU\ufffd\ufffd\u0018.\ufffd}]\ufffdl\ufffd\ufffd\ufffd^\u0013\ufffd\ufffd\u0017\ufffd \ufffdx\ufffd\ue17b5\ufffd{\ufffdW\ufffd\u0016\ufffd\ufffd+\ufffd\ufffd\ufffdB\ufffdSV\ufffdg\ufffdf\ufffd\ufffd\ufffd\ufffdk\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 10443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\u0517\ufffdOU\ufffd\ufffd.\ufffd}]\ufffdl\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd \ufffdx\ufffd\ue17b5\ufffd{\ufffdW\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffdB\ufffdSV\ufffdg\ufffdf\ufffd\ufffd\ufffd\ufffdk\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "minecraft probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)", "target_port_label": "10443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%", "classification_reason_label_fr": "Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 42, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 10443, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdY\ufffd\ufffd\u0517\ufffdOU\ufffd\ufffd\u0018.\ufffd}]\ufffdl\ufffd\ufffd\ufffd^\u0013\ufffd\ufffd\u0017\ufffd \ufffdx\ufffd\ue17b5\ufffd{\ufffdW\ufffd\u0016\ufffd\ufffd+\ufffd\ufffd\ufffdB\ufffdSV\ufffdg\ufffdf\ufffd\ufffd\ufffd\ufffdk\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 10443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "minecraft probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\u0517\ufffdOU\ufffd\ufffd.\ufffd}]\ufffdl\ufffd\ufffd\ufffd^\ufffd\ufffd\ufffd \ufffdx\ufffd\ue17b5\ufffd{\ufffdW\ufffd\ufffd\ufffd+\ufffd\ufffd\ufffdB\ufffdSV\ufffdg\ufffdf\ufffd\ufffd\ufffd\ufffdk\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "10443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 42 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 42 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "10443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "tls_clienthello" ] }
15/06/2026 18:23:27 UTC	TCP	10443 · HTTPS	https	Cross-site scripting xss attack · via HTTPS:10443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port http_get_probe mozi_pattern net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10443 Chemin / cible — Service HTTPS Payload GET / HTTP/1.1 Host: 62.3.50.33:10443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:10443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:10443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/a Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 400, "payload_entropy": 5.446326198617309, "port_category": "registered", "org": "PebbleHost Ltd", "service": "https", "app_proto": "https", "asn": 201002, "country": "SG", "dst_port": 10443, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 5.7, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 4, "anomaly_count": 0, "campaign_key": "3f4b6892caaa1664d1ac856a9bb3343298ca4195", "event_fingerprint": "0ce879e35222bcf244eb8071cb051f2e9c4aa580", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25eb964e2a5c699db23dd450da06ffe1", "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300" }, "target_context": { "dst_port": 10443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/a", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f709822405dbb5d4fc1a80a47a64cf9988bd12e0", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "port": 10443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "attack_vector": "xss attack \u00b7 via HTTPS:10443 \u00b7 (tentative d'exploit)", "target_port_label": "10443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTPS", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 10443, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "port": 10443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "xss attack \u00b7 via HTTPS:10443 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge", "target_port_label": "10443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "10443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "http_get_probe", "mozi_pattern", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
15/06/2026 17:41:10 UTC	TCP	444 · TLS	tls	Sonde TLS tls probe · via TLS:444 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 444 Chemin / cible — Service TLS Payload �Ꞻ�2Oj�a�y�Kڗ�hp �s �g]�T�x��D��+��3�?��a\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �Ꞻ�2Oj�a�y�Kڗ�hp �s �g]�T�x��D��+��3�?��a\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �Ꞻ�2Oj�a�y�Kڗ�hp �s �g]�T�x��D��+��3�?��a\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.28276693776623, "port_category": "well_known", "org": "PebbleHost Ltd", "service": "tls", "app_proto": "tls", "asn": 201002, "country": "SG", "dst_port": 444, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "9bff362b5e4b1fc54e3e921cb3112e46219b6d26", "event_fingerprint": "f3e384a0027885ca8fd17e522cb5c42cad935687", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "59458604038b662e88d373e882551fd1", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 444, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ua7ba\ufffd2Oj\ufffd\u0017\u0001a\ufffdy\u0014\u001f\u001d\ufffd\u000eK\u0697\ufffdhp\t\u0006\u0004\ufffds\r \u001e\ufffdg]\ufffdT\ufffdx\ufffd\ufffd\u0010\ufffdD\ufffd\ufffd\u000e\ufffd\ufffd\ufffd+\u001e\ufffd\u001b\ufffd3\ufffd\u0010?\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ua7ba\ufffd2Oj\ufffd\u0017\u0001a\ufffdy\u0014\u001f\u001d\ufffd\u000eK\u0697\ufffdhp\t\u0006\u0004\ufffds\r \u001e\ufffdg]\ufffdT\ufffdx\ufffd\ufffd\u0010\ufffdD\ufffd\ufffd\u000e\ufffd\ufffd\ufffd+\u001e\ufffd\u001b\ufffd3\ufffd\u0010?\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ua7ba\ufffd2Oj\ufffd\u0017\u0001a\ufffdy\u0014\u001f\u001d\ufffd\u000eK\u0697\ufffdhp\t\u0006\u0004\ufffds\r \u001e\ufffdg]\ufffdT\ufffdx\ufffd\ufffd\u0010\ufffdD\ufffd\ufffd\u000e\ufffd\ufffd\ufffd+\u001e\ufffd\u001b\ufffd3\ufffd\u0010?\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6487083f681ac3c4a0683c14edc254b34a5a2246", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ua7ba\ufffd2Oj\ufffd\u0017\u0001a\ufffdy\u0014\u001f\u001d\ufffd\u000eK\u0697\ufffdhp\t\u0006\u0004\ufffds\r \u001e\ufffdg]\ufffdT\ufffdx\ufffd\ufffd\u0010\ufffdD\ufffd\ufffd\u000e\ufffd\ufffd\ufffd+\u001e\ufffd\u001b\ufffd3\ufffd\u0010?\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 444, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ua7ba\ufffd2Oj\ufffda\ufffdy\ufffdK\u0697\ufffdhp\t\ufffds\r \ufffdg]\ufffdT\ufffdx\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd3\ufffd?\ufffd\ufffda\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:444 \u00b7 (sonde \/ probe)", "target_port_label": "444 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 444, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ua7ba\ufffd2Oj\ufffd\u0017\u0001a\ufffdy\u0014\u001f\u001d\ufffd\u000eK\u0697\ufffdhp\t\u0006\u0004\ufffds\r \u001e\ufffdg]\ufffdT\ufffdx\ufffd\ufffd\u0010\ufffdD\ufffd\ufffd\u000e\ufffd\ufffd\ufffd+\u001e\ufffd\u001b\ufffd3\ufffd\u0010?\ufffd\ufffda\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 444, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:444 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ua7ba\ufffd2Oj\ufffda\ufffd*y\ufffdK\u0697\ufffdhp\t\ufffds\r \ufffdg]\ufffdT\ufffdx\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\ufffd3\ufffd?\ufffd\ufffda\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "444 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "444" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
15/06/2026 17:41:10 UTC	TCP	444 · HTTP	http	Cross-site scripting xss attack · via HTTP:444 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 444 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:444 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Geck Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:444 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apn Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "96bd0f703b966543acff1c39b6284d0525249c56", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 398, "payload_entropy": 5.446456280899783, "port_category": "well_known", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "dst_port": 444, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c02fb3bcc273c8fd3be8f696c320db486a417907", "event_fingerprint": "e3b2a8940292f7405bc2501dc600449c01969c65", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "59a906be8ee66c411f0b3bc46e176960", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 444, "service": "http", "service_name": "http", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:444\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:444\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apn", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:444\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:444\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apn", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:444\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c0e3a34a1e5c2b3b6839048d37381c7b3abaf3f2", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 444, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:444\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "attack_vector": "xss attack \u00b7 via HTTP:444 \u00b7 (tentative d'exploit)", "target_port_label": "444 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 44, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 444, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 444, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:444 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:444\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Geck", "target_port_label": "444 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "444" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
15/06/2026 15:34:28 UTC	TCP	7443 · ORACLE EM	oracle-em	oracle tns probe oracle tns probe · via ORACLE EM:7443 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur ORACLE-EM WAF — Recommandation Surveiller Tags net_oracle_tns_probe oracle_em_emulated oracle_em_payload tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7443 Chemin / cible — Service ORACLE EM Payload ��)�m��W0[��ऀ.?�BK'=I �Iz�C�]88 4��J��c�? �V�ұ�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « oracle_tns_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��)�m��W0[��ऀ.?�BK'=I �Iz�C�]88 4��J��c�? �V�ұ�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) ��)�m��W0[��ऀ.?�BK'=I �Iz�C�]88 4��J��c�? �V�ұ�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 4.28442295192295, "port_category": "registered", "org": "PebbleHost Ltd", "service": "oracle-em", "app_proto": "oracle-em", "asn": 201002, "country": "SG", "dst_port": 7443, "risk_waf": 8, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "4f4acff4c9041c67c73fa498ee94611b63a0dc4b", "event_fingerprint": "3f1d4b52645bcd9531502ab86dc099f88926bef6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "service_name": "oracle-em", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e06b8add1bb0263ffcff70020bd48e92", "path_pattern_hash": "420e91c120535c16728a9791d446fafc" }, "target_context": { "dst_port": 7443, "service": "oracle-em", "service_name": "oracle-em", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0010)\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdW0\u0018[\u0012\ufffd\ufffd\u0900\u0012.?\ufffdBK\u0001'=I \ufffdIz\ufffdC\ufffd\u0003]8\u00148\t\uec194\ufffd\ufffdJ\ufffd\u001d\ufffdc\ufffd?\n\ufffdV\ufffd\u04b1\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0010)\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdW0\u0018[\u0012\ufffd\ufffd\u0900\u0012.?\ufffdBK\u0001'=I \ufffdIz\ufffdC\ufffd\u0003]8\u00148\t\uec194\ufffd\ufffdJ\ufffd\u001d\ufffdc\ufffd?\n\ufffdV\ufffd\u04b1\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0010)\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdW0\u0018[\u0012\ufffd\ufffd\u0900\u0012.?\ufffdBK\u0001'=I \ufffdIz\ufffdC\ufffd\u0003]8\u00148\t\uec194\ufffd\ufffdJ\ufffd\u001d\ufffdc\ufffd?\n\ufffdV\ufffd\u04b1\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8390ca2b70817680c922ea07fa8b887a121835c3", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0010)\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdW0\u0018[\u0012\ufffd\ufffd\u0900\u0012.?\ufffdBK\u0001'=I \ufffdIz\ufffdC\ufffd\u0003]8\u00148\t\uec194\ufffd\ufffdJ\ufffd\u001d\ufffdc\ufffd?\n\ufffdV\ufffd\u04b1\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "evidence_snippet": "\ufffd\ufffd\ufffd)\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdW0[\ufffd\ufffd\u0900.?\ufffdBK'=I \ufffdIz\ufffdC\ufffd]88\t\uec194\ufffd\ufffdJ\ufffd\ufffdc\ufffd?\n\ufffdV\ufffd\u04b1\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab oracle_tns_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 54, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "oracle-em", "service_label_fr": "ORACLE EM", "dst_port": 7443, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-oracle-em", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0002\ufffd\u0010)\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdW0\u0018[\u0012\ufffd\ufffd\u0900\u0012.?\ufffdBK\u0001'=I \ufffdIz\ufffdC\ufffd\u0003]8\u00148\t\uec194\ufffd\ufffdJ\ufffd\u001d\ufffdc\ufffd?\n\ufffdV\ufffd\u04b1\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 7443, "service": "oracle-em", "service_label_fr": "ORACLE EM" }, "attack_vector": "oracle tns probe \u00b7 via ORACLE EM:7443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd)\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffdW0[\ufffd\ufffd\u0900.?\ufffdBK'=I \ufffdIz\ufffdC\ufffd]88\t\uec194\ufffd\ufffdJ\ufffd\ufffdc\ufffd?\n\ufffdV\ufffd\u04b1\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "7443 \u00b7 ORACLE EM", "emulator_service": "oracle-em", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "oracle_em", "service_banner": "honeypot-oracle-em", "service_os": "linux", "dst_port": "7443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_oracle_tns_probe", "oracle_em_emulated", "oracle_em_payload", "tls_clienthello" ] }
15/06/2026 15:34:28 UTC	TCP	7443 · HTTP	http	Cross-site scripting xss attack · via HTTP:7443 · (tentative d'exploit)	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7443 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "3207cc58a88e4dd65c61f1b1f14e699cc0722bbe", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.448361973417362, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "dst_port": 7443, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 43, "tag_count": 4, "anomaly_count": 0, "campaign_key": "40005da017bef00b97976ebf3705f97aaa28ab5f", "event_fingerprint": "461b83f7014fe619299b1b3ff6a2153181db3ce3", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "7b5a26352b27fc518c2d16e80647e81c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7443, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9b68035d3d806dfddfbcfb7209ff5ce5ec15ae73", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7443, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:7443 \u00b7 (tentative d'exploit)", "target_port_label": "7443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7443, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 7443, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:7443 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "7443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "oracle-em" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
15/06/2026 15:28:05 UTC	TCP	5443 · TLS	tls	Sonde TLS tls probe · via TLS:5443 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 511534a5dbb14457 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5443 Chemin / cible — Service TLS Payload �Ms�� є��L��V��p�,� �M�X�PG� X��xt_I&N��&7�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �Ms��є��L��V��p�,� �M�X�PG� X��xt_I&N��&7�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �Ms�� є��L��V��p�,� �M�X�PG� X��xt_I&N��&7�\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "tls_ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 6, "bytes_in": 517, "payload_entropy": 4.240438441262511, "port_category": "registered", "org": "PebbleHost Ltd", "service": "tls", "app_proto": "tls", "asn": 201002, "country": "SG", "dst_port": 5443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "38f4503bf18c3e5e5b8d3cb7e422a4dd8bfca84f", "event_fingerprint": "8c31c0776847e7f1ad0cf3030bda0c3260cd264a", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "511534a5dbb144576d046b0d2aeb5fb7", "payload_hash": "cf1ed91a6cd9ce7c601c1fb7c5918b22", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 5443, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ms\ufffd\ufffd\ufffd\ufffd\u001b\u000b\ufffd\ufffd\ufffd\u0454\ufffd\ufffdL\ufffd\ufffd\u0000\u0010\ufffd\ufffdV\ufffd\u0015\ufffd\ufffd\ufffdp\ufffd,\ufffd \ufffdM\ufffdX\ufffdPG\ufffd\tX\ufffd\ufffdxt_I&N\ufffd\ufffd\u0000\u0002\u0002\ufffd\u001b\ufffd\ufffd\ufffd\u001d&7\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ms\ufffd\ufffd\ufffd\ufffd\u001b\u000b\ufffd\ufffd\ufffd\u0454\ufffd\ufffdL\ufffd\ufffd\u0000\u0010\ufffd\ufffdV\ufffd\u0015\ufffd\ufffd\ufffdp\ufffd,\ufffd \ufffdM\ufffdX\ufffdPG\ufffd\tX\ufffd\ufffdxt_I&N\ufffd\ufffd\u0000\u0002\u0002\ufffd\u001b\ufffd\ufffd\ufffd\u001d&7\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ms\ufffd\ufffd\ufffd\ufffd\u001b\u000b\ufffd\ufffd\ufffd\u0454\ufffd\ufffdL\ufffd\ufffd\u0000\u0010\ufffd\ufffdV\ufffd\u0015\ufffd\ufffd\ufffdp\ufffd,\ufffd \ufffdM\ufffdX\ufffdPG\ufffd\tX\ufffd\ufffdxt_I&N\ufffd\ufffd\u0000\u0002\u0002\ufffd\u001b\ufffd\ufffd\ufffd\u001d&7\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "df07d54af14df72eb913eb4252011fd641f26661", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ms\ufffd\ufffd\ufffd\ufffd\u001b\u000b\ufffd\ufffd\ufffd\u0454\ufffd\ufffdL\ufffd\ufffd\u0000\u0010\ufffd\ufffdV\ufffd\u0015\ufffd\ufffd\ufffdp\ufffd,\ufffd \ufffdM\ufffdX\ufffdPG\ufffd\tX\ufffd\ufffdxt_I&N\ufffd\ufffd\u0000\u0002\u0002\ufffd\u001b\ufffd\ufffd\ufffd\u001d&7\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5443, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdMs\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0454\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffdp\ufffd,\ufffd \ufffdM\ufffdX\ufffdPG\ufffd\tX\ufffd\ufffdxt_I&N\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&7\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "tls probe \u00b7 via TLS:5443 \u00b7 (sonde \/ probe)", "target_port_label": "5443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5443, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Ms\ufffd\ufffd\ufffd\ufffd\u001b\u000b\ufffd\ufffd\ufffd\u0454\ufffd\ufffdL\ufffd\ufffd\u0000\u0010\ufffd\ufffdV\ufffd\u0015\ufffd\ufffd\ufffdp\ufffd,\ufffd \ufffdM\ufffdX\ufffdPG\ufffd\tX\ufffd\ufffdxt_I&N\ufffd\ufffd\u0000\u0002\u0002\ufffd\u001b\ufffd\ufffd\ufffd\u001d&7\ufffd\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "tls_ja3": "511534a5dbb144576d046b0d2aeb5fb7", "port": 5443, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:5443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdMs\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0454\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffdp\ufffd,\ufffd \ufffdM\ufffdX\ufffdPG\ufffd\tX\ufffd\ufffdxt_I&N\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&7\ufffd\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "5443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
15/06/2026 15:28:05 UTC	TCP	5443 · HTTP	http	Cross-site scripting xss attack · via HTTP:5443 · (tentative d'exploit)	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5443 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5443 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "8c63977d5d0c71f59418955e62bca1981dfcfc04", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.447448369465984, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "dst_port": 5443, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "934d057e5d2b88c4f777c08b9fd5222a84a20ea9", "event_fingerprint": "b38be6657f601aa8f7889eccd7132a23c3d252e3", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "149f7630687d7a2eac81908378b54998", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 5443, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bd947b257325336f602d7bf1a2aacc97fb48baac", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5443, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:5443 \u00b7 (tentative d'exploit)", "target_port_label": "5443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5443, "protocol_emulated": null, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 5443, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:5443 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "5443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "behavior_alert_count": 1, "behavior_priority": 96 }
15/06/2026 14:44:58 UTC	TCP	8082 · HTTP ALT 8082	http-alt-8082	http-alt-8082 http-alt-8082 · via HTTP ALT 8082:8082 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8082 WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8082 Chemin / cible — Service HTTP ALT 8082 Payload �@%�f�o}�Nǀ ?$�� 6��rRa=�:/Ji m��,u�\|�lDG`�5�ذ��y;�7}� �޲\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Pourquoi cette classification : Type « http-alt-8082 » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �@%�f�o}�Nǀ?$�� 6��rRa=�:/Ji m��,u�\|�lDG`�5�ذ��y;�7}� �޲\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v Requête brute (extrait) �@%�f�o}�Nǀ ?$�� 6��rRa=�:/Ji m��,u�\|�lDG`�5�ذ��y;�7}� �޲\�,�0̨̩��]�a�+�/��\�`�$�(�s�w�#�'�r�v� �� Q��P=�<�5�/A�W # ( Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 517, "payload_entropy": 4.318182267961231, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http-alt-8082", "app_proto": "http-alt-8082", "asn": 201002, "country": "SG", "dst_port": 8082, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "3888d1be70f33732522d873896cc453ceef75286", "event_fingerprint": "0e49cbf0cd38e11c005312d70c60a0ee389bb82f", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "service_name": "http-alt-8082", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "294e970dfcec24b7609d0a61e8380ddb", "path_pattern_hash": "ab911db9a03f822d13fe3595fc5be734" }, "target_context": { "dst_port": 8082, "service": "http-alt-8082", "service_name": "http-alt-8082", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003@%\ufffdf\ufffd\u0013o}\ufffdN\u01c0\u000b?\u0011$\ufffd\ufffd\r6\ufffd\ufffdrRa=\ufffd:\/J\u0011i m\ufffd\ufffd,u\ufffd\u0010\|\ufffdlDG`\ufffd5\ufffd\u0630\ufffd\ufffd\u0003y;\ufffd7}\ufffd\u0012\r\ufffd\u07b2\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003@%\ufffdf\ufffd\u0013o}\ufffdN\u01c0\u000b?\u0011$\ufffd\ufffd\r6\ufffd\ufffdrRa=\ufffd:\/J\u0011i m\ufffd\ufffd,u\ufffd\u0010\|\ufffdlDG`\ufffd5\ufffd\u0630\ufffd\ufffd\u0003y;\ufffd7}\ufffd\u0012\r\ufffd\u07b2\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv\ufffd\n\ufffd\u0014\ufffd\t\ufffd\u0013\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000A\u0000\ufffd\u0001\u0000\u0001W\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003@%\ufffdf\ufffd\u0013o}\ufffdN\u01c0\u000b?\u0011$\ufffd\ufffd\r6\ufffd\ufffdrRa=\ufffd:\/J\u0011i m\ufffd\ufffd,u\ufffd\u0010\|\ufffdlDG`\ufffd5\ufffd\u0630\ufffd\ufffd\u0003y;\ufffd7}\ufffd\u0012\r\ufffd\u07b2\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "classification_reason": "Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "158cb7aa41a95ee9b0d52d9401c2b6aed53b6603", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003@%\ufffdf\ufffd\u0013o}\ufffdN\u01c0\u000b?\u0011$\ufffd\ufffd\r6\ufffd\ufffdrRa=\ufffd:\/J\u0011i m\ufffd\ufffd,u\ufffd\u0010\|\ufffdlDG`\ufffd5\ufffd\u0630\ufffd\ufffd\u0003y;\ufffd7}\ufffd\u0012\r\ufffd\u07b2\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "evidence_snippet": "\ufffd@%\ufffdf\ufffdo}\ufffdN\u01c0?$\ufffd\ufffd\r6\ufffd\ufffdrRa=\ufffd:\/Ji m\ufffd\ufffd,u\ufffd\|\ufffdlDG`\ufffd5\ufffd\u0630\ufffd\ufffdy;\ufffd7}\ufffd\r\ufffd\u07b2\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "attack_vector": "http-alt-8082 \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)", "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "http-alt-8082", "service_label_fr": "HTTP ALT 8082", "dst_port": 8082, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8082", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003@%\ufffdf\ufffd\u0013o}\ufffdN\u01c0\u000b?\u0011$\ufffd\ufffd\r6\ufffd\ufffdrRa=\ufffd:\/J\u0011i m\ufffd\ufffd,u\ufffd\u0010\|\ufffdlDG`\ufffd5\ufffd\u0630\ufffd\ufffd\u0003y;\ufffd7}\ufffd\u0012\r\ufffd\u07b2\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "attack_vector": "http-alt-8082 \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd@%\ufffdf\ufffdo}\ufffdN\u01c0?$\ufffd\ufffd\r6\ufffd\ufffdrRa=\ufffd:\/Ji m\ufffd\ufffd,u\ufffd\|\ufffdlDG`\ufffd5\ufffd\u0630\ufffd\ufffdy;\ufffd7}\ufffd\r\ufffd\u07b2\\\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffd$\ufffd(\ufffds\ufffdw\ufffd#\ufffd'\ufffdr\ufffdv", "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8082", "service_banner": "honeypot-http-alt-8082", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
15/06/2026 14:44:58 UTC	TCP	8082 · HTTP	http	Cross-site scripting xss attack · via HTTP:8082 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8082 Chemin / cible / Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 67% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 59 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 SSRF Any-address SSRF Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8082 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8082 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/ap Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "7a8d0e6c280b76f893f1d973fb51ae53b8bb4673", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.455349784579637, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "dst_port": 8082, "risk_waf": 72, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 4, "anomaly_count": 0, "campaign_key": "7ccf9af03d8f8e8c7839c4df77a4a032322efde1", "event_fingerprint": "24e45377946a33b2067be73083ee876944b91034", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.67, "classification_confidence": 0.67, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284", "pat-0324" ], "matched_pattern_names": [ "CRS 941130", "SSRF Any-address SSRF" ], "pattern_ids": [ "pat-0284", "pat-0324" ], "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SG", "asn": 201002, "org": "PebbleHost Ltd", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b5696a699925e22006af19488170e4e2", "payload_hash": "13ac96e1071c61d8b10b4964687b49b1", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 46 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/ap", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6642314bef2b7f8d0e29cc6d14e0a9b1c8c6a077", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "xss attack \u00b7 via HTTP:8082 \u00b7 (tentative d'exploit)", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 67, "confidence_breakdown": { "waf": 72, "classification": 68, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/140.0.0.0 Safari\/537.36", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:8082 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8082\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8082" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ] }
24/05/2026 09:11:25 UTC	TCP	9443	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
24/05/2026 09:11:25 UTC	TCP	9443	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 9443 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "16538a1bcfcc9930ab514bb8cc61e117e087fd04", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.449590607491731, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "11487d78e75bf58523d39b43d59a0e8556f7b8af", "event_fingerprint": "e597fb3490c397306741fba0befe3cfff27ee87a", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
24/05/2026 08:54:30 UTC	TCP	8080	tls	Sonde TLS	Élevée	Moyen · 57
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
24/05/2026 08:54:30 UTC	TCP	8080	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.447336620236348, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "b51a116142cf08521dc3211ea8a2c990384b6a4c", "event_fingerprint": "5d0b1f96b1f1257fd0e98e0d537c9ec89e8e500b", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
24/05/2026 08:34:09 UTC	TCP	10443	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
24/05/2026 08:34:09 UTC	TCP	10443	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 10443 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "2cf5af0b13931b66cab59dd3d82974768acd327c", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.446326198617309, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "cd64762cbd3ef3323a0aeac3a15365262002e9ae", "event_fingerprint": "abab8689f9cd2396c292ea70c91cf9363a23bbce", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 12:46:56 UTC	TCP	11443	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 12:46:56 UTC	TCP	11443	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11443 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "9ef1b6d504b654fe06cbbf3870a4ee75ac65add6", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 400, "payload_entropy": 5.449291278110535, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "a3e4e41439439815f3310e94cc4e547074546a28", "event_fingerprint": "997ff8ab26e676cad596561f36d6b12bff17f32f", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 12:31:29 UTC	TCP	4443	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 12:31:29 UTC	TCP	4443	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4443 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "e950df8a5a68e4dcc53c2ea4813456e73c1d6fc9", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.446720314189158, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "b3ca9ddfeb2b1d0d1337a0674f54405e063a997c", "event_fingerprint": "46787207b8bb4667f0a216f439d637abf48dc130", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 10:53:24 UTC	TCP	8070	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 10:53:24 UTC	TCP	8070	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8070 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "2045de7887174d9bf5c5f3b488b17b4b583ca139", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.446107986161978, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "eaa48e0827bebd6503b7a29b01c4086a03f79dd6", "event_fingerprint": "69761c2c67d85c9fd9cf7cb43cbb86cce95aedcb", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 10:22:55 UTC	TCP	8043	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 10:22:55 UTC	TCP	8043	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8043 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "a21e8130412410f8da5d7966dea2817810a196f5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.44778199007173, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "40f4ab308184d391b818a66b7e9f228671d38d33", "event_fingerprint": "8b9839a20f97e3cff669ffd346e3f11eb7aaad9c", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 10:16:11 UTC	TCP	8055	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 10:16:11 UTC	TCP	8055	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8055 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "78f6410bb0ab477a6e31a52663085df6b008f579", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.4484453046243395, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "2ee8751bef4e4df020c3b06526bc106109365b6d", "event_fingerprint": "bcf9b3974c43716979ec3f470b4a24b439a9f4e9", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 09:57:53 UTC	TCP	8039	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 09:57:53 UTC	TCP	8039	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8039 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "d3f8e236839961e21210ff9f9a1330d79c3cb9e9", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.4490106241461, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "1ee16b12c1d7fc01ded9015c16ca5ea27ca7797d", "event_fingerprint": "e4ecdbd62c448782ce560bb06678e3a5849f3af4", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 09:42:23 UTC	TCP	8063	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 09:42:23 UTC	TCP	8063	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8063 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "11ef6ad8aa285418b50a4ce38f4f9b5338f66439", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.4461403308435266, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "ce7e614c4bd52b332a6d6c758e333de7f15ad3b4", "event_fingerprint": "a43f939a1402c77a2a289a1971522c075297e8f3", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 08:28:28 UTC	TCP	8092	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 08:28:28 UTC	TCP	8092	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8092 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "96b332f68b851994e64106cc7a7e4bc3f620096d", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.455349784579637, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "b44556c7d13b2997ce82b36138b5e3a5e3f2c68b", "event_fingerprint": "fb1f1936b1303a16400aa86ae959c84fa991a9b4", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 08:13:14 UTC	TCP	8008	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 08:13:14 UTC	TCP	8008	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8008 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "2f04469f58c087671b6a6ba85c59ddf7574837ab", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.447336620236348, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "40b2fb2faa5eeeaa66f4b9be6c4318ce218cfa8d", "event_fingerprint": "bb9133595103ef077b7f4a33ee4e8414f3b782a1", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 07:30:03 UTC	TCP	8085	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 07:30:03 UTC	TCP	8085	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.451315597926913, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "d8886d36a36e5e7e490975e0991baeb22205c72f", "event_fingerprint": "39b0e5af9c5a517e28c065fe67fd86bf8be318fa", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 07:29:01 UTC	TCP	8084	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 07:29:01 UTC	TCP	8084	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8084 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "52139ff216422f6e734a2f69155b92f0ec67e9f8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.452229201878291, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "725acd910458c30c9123c8d5ff30297343eac087", "event_fingerprint": "48a526e05534d8539f5d9361c06873fd5b78138c", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 07:12:00 UTC	TCP	8072	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 07:12:00 UTC	TCP	8072	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8072 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "27f1dd72fe3d86ab720a36799bf3501f85a109d7", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.454121150505268, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "c64e6435bf6090f53e759a818c7976dc5ca12d84", "event_fingerprint": "d8cb2cdcc58962377de66e6a6ce7053774ded4f6", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }
23/05/2026 06:41:43 UTC	TCP	8093	tls	Sonde TLS	Moyenne	Faible · 33
Étape — WAF — Recommandation — Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
23/05/2026 06:41:43 UTC	TCP	8093	http	web attack	Élevée	Critique · 100
Étape — WAF 16 Recommandation — Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8093 Chemin / cible / Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Règles WAF 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "0cb97fa2c09bb17e5169eb608f71e610635ab915", "http_host_hash": "f4fa47ba93fbf7d5760822f3260769e77df88191", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 399, "payload_entropy": 5.4490106241461, "port_category": "registered", "org": "PebbleHost Ltd", "service": "http", "app_proto": "http", "asn": 201002, "country": "SG", "tag_count": 3, "anomaly_count": 0, "risk_score": 100, "campaign_key": "5b75108e3a14ce19d735a6524345f412afdba171", "event_fingerprint": "d929217a9b473bf2bf8776e1b32a9f2c23c1ed06", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950734:sap-sapcontrol-path" ] }

193.8.186.29

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence