|
|
TCP |
3005 · HTTP
|
http
|
file upload abuse
file upload abuse · via HTTP:3005 · (tentative d'exploit)
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950549:upload-0
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
3005
Chemin / cible
/
Pourquoi cette classification : Règle WAF « upload-0 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — 5 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Règles WAF
rce-0
rce-14
nosqli-3
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3005 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-ali
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "45cd2dc9ccddb99e6b4e3c5e97e74b55816fb624",
"http_host_hash": "99e2017216b0aba2a9ba1647c3ed96d0b53169da",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.618808124453334,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3005,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1d83b522b5a3eed689d17a088921d0976addab4d",
"event_fingerprint": "457f76c0bd11f20393ea402a95a6395fdd7bf4c9",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ce37be868859227ea4f6c38c9b89bbc0",
"payload_hash": "57537edb7feda93765e1e1ff4a2cbd57",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3005,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d7c06ce0ead263905d92c6d54bcd8d9a462a1b5a",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "file upload abuse \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit)",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3005,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "file upload abuse \u00b7 via HTTP:3005 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface"
]
}
|
|
|
TCP |
3005 · HTTP
|
http
|
Sonde port 3005/TCP
port 3005 tcp · via HTTP:3005 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
HEAD / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
HEAD
/
TLS SNI
—
Capteur
paris-1
|
Méthode
HEAD
Port
3005
Chemin / cible
/
Preuve honeypot — Sonde port 3005/TCP
Connexion détectée sur le port 3005 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3005_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
HEAD / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
HEAD / HTTP/1.1
Host: 62.3.50.33:3005
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, zstd
Accept: */*
C
Requête brute (extrait)
HEAD / HTTP/1.1 Host: 62.3.50.33:3005 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "99e2017216b0aba2a9ba1647c3ed96d0b53169da",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "HEAD",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 153,
"payload_entropy": 5.09706192555844,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3005,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "2636dbe8f92c82de59f3a2938c2d0cfa71245bf8",
"event_fingerprint": "80190e0ff7bd9327bf5be6611e5ffa4e72ed5e7b",
"classification_reason": "Type \u00ab port_3005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "edb0711a221ed6389d233c7305489106",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3005,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"evidence": {
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"classification_reason": "Type \u00ab port_3005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "06c0942d3a7021354ec680e13d06e2b48637e38a",
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"attack_vector": "port 3005 tcp \u00b7 via HTTP:3005 \u00b7 (sonde \/ probe)",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3005,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3005 tcp \u00b7 via HTTP:3005 \u00b7 (sonde \/ probe)",
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3005\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"target_port_label": "3005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|
|
|
TCP |
3000 · HTTP
|
http
|
file upload abuse
file upload abuse · via HTTP:3000 · (tentative d'exploit)
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950549:upload-0
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
3000
Chemin / cible
/
Pourquoi cette classification : Règle WAF « upload-0 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — 5 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Règles WAF
rce-0
rce-14
nosqli-3
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-ali
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "45cd2dc9ccddb99e6b4e3c5e97e74b55816fb624",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.616768260787883,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3000,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e3ef900fde45533a7cdc55879154a31efc4dadd6",
"event_fingerprint": "038a6ef80c8199358c1736e15c91f447d57ed85c",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ce37be868859227ea4f6c38c9b89bbc0",
"payload_hash": "76115d040198ec58eb655bafa0f198ab",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d585ed33f213cbed05041669bd93dd916a0960b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "file upload abuse \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "file upload abuse \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"net_web_probe"
]
}
|
|
|
TCP |
3000 · HTTP
|
http
|
Sonde port 3000/TCP
port 3000 tcp · via HTTP:3000 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
HEAD / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
HEAD
/
TLS SNI
—
Capteur
paris-1
|
Méthode
HEAD
Port
3000
Chemin / cible
/
Preuve honeypot — Sonde port 3000/TCP
Connexion détectée sur le port 3000 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3000_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
HEAD / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
HEAD / HTTP/1.1
Host: 62.3.50.33:3000
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, zstd
Accept: */*
C
Requête brute (extrait)
HEAD / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
"emulator_response_len": 106,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "HEAD",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 153,
"payload_entropy": 5.0938578406194,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3000,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 38,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "927330bae2b735b83734c72394d6cd42511d5a48",
"event_fingerprint": "df26cf898ae5f0610350f635244b0d9bf75cc29c",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "f8a31fc18b932109aa93bf31ca4d4f9a",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3000,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"evidence": {
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "58e5c1869d7bf0f1680a167fac93abb42c17c417",
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3000,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3000 tcp \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"target_port_label": "3000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"net_web_probe",
"scanner-ua"
]
}
|
|
|
TCP |
3018 · HTTP
|
http
|
file upload abuse
file upload abuse · via HTTP:3018 · (tentative d'exploit)
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950549:upload-0
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
3018
Chemin / cible
/
Pourquoi cette classification : Règle WAF « upload-0 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — 5 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Règles WAF
rce-0
rce-14
nosqli-3
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3018
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3018 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-ali
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "45cd2dc9ccddb99e6b4e3c5e97e74b55816fb624",
"http_host_hash": "d43409e4c56c4641b9e20e7144d60e4acf02d43f",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.624376562122317,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3018,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "5f140d35c5884640b6fd3bcd5e20660488b3da74",
"event_fingerprint": "6b25b2c4be97dcbf66767a973f8f521336646942",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ce37be868859227ea4f6c38c9b89bbc0",
"payload_hash": "9d01194c5258dee8ca4ce566ed5e81d4",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3018,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ad7eaf05ff5c9a0b893f95f7c5f65ae54704734",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3018,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "file upload abuse \u00b7 via HTTP:3018 \u00b7 (tentative d'exploit)",
"target_port_label": "3018 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3018,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3018,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "file upload abuse \u00b7 via HTTP:3018 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "3018 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3018"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface"
]
}
|
|
|
TCP |
3018 · HTTP
|
http
|
Sonde port 3018/TCP
port 3018 tcp · via HTTP:3018 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
HEAD / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
HEAD
/
TLS SNI
—
Capteur
paris-1
|
Méthode
HEAD
Port
3018
Chemin / cible
/
Preuve honeypot — Sonde port 3018/TCP
Connexion détectée sur le port 3018 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3018_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
HEAD / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
HEAD / HTTP/1.1
Host: 62.3.50.33:3018
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, zstd
Accept: */*
C
Requête brute (extrait)
HEAD / HTTP/1.1 Host: 62.3.50.33:3018 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "d43409e4c56c4641b9e20e7144d60e4acf02d43f",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "HEAD",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 153,
"payload_entropy": 5.115067726226174,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3018,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "c0c7cf03bdb69af844dd2793e793e0121ed6cf3b",
"event_fingerprint": "8c5d08c99d30b8834fce4f739e1c7a9f305b0e51",
"classification_reason": "Type \u00ab port_3018_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "138254e86839f0feec750b5189a21c63",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3018,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"evidence": {
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"classification_reason": "Type \u00ab port_3018_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6864e9cd725e8e21eae0feeb72e3811c9b5c00ff",
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3018,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"attack_vector": "port 3018 tcp \u00b7 via HTTP:3018 \u00b7 (sonde \/ probe)",
"target_port_label": "3018 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3018_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3018_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3018,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3018,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3018 tcp \u00b7 via HTTP:3018 \u00b7 (sonde \/ probe)",
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3018\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"target_port_label": "3018 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3018"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|
|
|
TCP |
3004 · HTTP
|
http
|
file upload abuse
file upload abuse · via HTTP:3004 · (tentative d'exploit)
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950549:upload-0
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
3004
Chemin / cible
/
Pourquoi cette classification : Règle WAF « upload-0 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — 5 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Règles WAF
rce-0
rce-14
nosqli-3
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3004
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3004 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-ali
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "45cd2dc9ccddb99e6b4e3c5e97e74b55816fb624",
"http_host_hash": "97c1cb9b3333c4717f6db702914c65b654b8c5df",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.621803420237163,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3004,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "490a87978911dcf3eb84f0f93c96737fd37aa496",
"event_fingerprint": "bf29e065d60a1adc3f402cd20e874f312acf65ca",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ce37be868859227ea4f6c38c9b89bbc0",
"payload_hash": "e1c620f176b75dfd5c6d3f49b3c99ea7",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3004,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a37011ce876df880ec78c6e1b7ce3d87d84f5f65",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3004,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "file upload abuse \u00b7 via HTTP:3004 \u00b7 (tentative d'exploit)",
"target_port_label": "3004 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3004,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3004,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "file upload abuse \u00b7 via HTTP:3004 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "3004 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3004"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface"
]
}
|
|
|
TCP |
3004 · HTTP
|
http
|
Sonde port 3004/TCP
port 3004 tcp · via HTTP:3004 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
HEAD / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
HEAD
/
TLS SNI
—
Capteur
paris-1
|
Méthode
HEAD
Port
3004
Chemin / cible
/
Preuve honeypot — Sonde port 3004/TCP
Connexion détectée sur le port 3004 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3004_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
HEAD / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
HEAD / HTTP/1.1
Host: 62.3.50.33:3004
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, zstd
Accept: */*
C
Requête brute (extrait)
HEAD / HTTP/1.1 Host: 62.3.50.33:3004 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "97c1cb9b3333c4717f6db702914c65b654b8c5df",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "HEAD",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 153,
"payload_entropy": 5.115067726226174,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3004,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "57745cd687ee4fb886bc84e5a8af51540e2976bc",
"event_fingerprint": "a7cf3f7fcd1d81e1451fd6125090da835f771104",
"classification_reason": "Type \u00ab port_3004_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "34da1ff172d63a3e0ea06eee635c1169",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3004,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"evidence": {
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"classification_reason": "Type \u00ab port_3004_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7683ce2412b9101a900322371a84534751cd7bd2",
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3004,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"attack_vector": "port 3004 tcp \u00b7 via HTTP:3004 \u00b7 (sonde \/ probe)",
"target_port_label": "3004 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3004_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3004_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3004,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3004,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3004 tcp \u00b7 via HTTP:3004 \u00b7 (sonde \/ probe)",
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3004\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"target_port_label": "3004 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3004"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|
|
|
TCP |
3015 · HTTP
|
http
|
file upload abuse
file upload abuse · via HTTP:3015 · (tentative d'exploit)
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950549:upload-0
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
3015
Chemin / cible
/
Pourquoi cette classification : Règle WAF « upload-0 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — 5 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Règles WAF
rce-0
rce-14
nosqli-3
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3015
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3015 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-ali
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "45cd2dc9ccddb99e6b4e3c5e97e74b55816fb624",
"http_host_hash": "c6b5543d8168c56d1c60d3796531b1251d3fb054",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.619750839767941,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3015,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "68bb4c3948b8df86174b2beb10057af0de45a4cd",
"event_fingerprint": "0d4e3060c5e171489664b250e3dde6833f7b5155",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 58
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ce37be868859227ea4f6c38c9b89bbc0",
"payload_hash": "c3f24a075bf16d56939a887e0198e03d",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3015,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d0f0f678f44f7bdf57a83ce1baaf5adf1e7ef9be",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3015,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "file upload abuse \u00b7 via HTTP:3015 \u00b7 (tentative d'exploit)",
"target_port_label": "3015 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 58
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3015,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3015,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "file upload abuse \u00b7 via HTTP:3015 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "3015 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3015"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface"
]
}
|
|
|
TCP |
3015 · HTTP
|
http
|
Sonde port 3015/TCP
port 3015 tcp · via HTTP:3015 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
HEAD / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
HEAD
/
TLS SNI
—
Capteur
paris-1
|
Méthode
HEAD
Port
3015
Chemin / cible
/
Preuve honeypot — Sonde port 3015/TCP
Connexion détectée sur le port 3015 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3015_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
HEAD / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
HEAD / HTTP/1.1
Host: 62.3.50.33:3015
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, zstd
Accept: */*
C
Requête brute (extrait)
HEAD / HTTP/1.1 Host: 62.3.50.33:3015 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "c6b5543d8168c56d1c60d3796531b1251d3fb054",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "HEAD",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 153,
"payload_entropy": 5.09706192555844,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3015,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "bc830e3dc02552cfe642b886bc40bc162bf08828",
"event_fingerprint": "1b38d41373302b45f369408996ca9d1e27aae0ad",
"classification_reason": "Type \u00ab port_3015_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "eebcfe24ec42862d450ae6e3b36b3e2f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3015,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"evidence": {
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"classification_reason": "Type \u00ab port_3015_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "90200d17326de9850518d0bc0b80c5b1f428e6d2",
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3015,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"attack_vector": "port 3015 tcp \u00b7 via HTTP:3015 \u00b7 (sonde \/ probe)",
"target_port_label": "3015 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3015_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3015_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3015,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3015,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3015 tcp \u00b7 via HTTP:3015 \u00b7 (sonde \/ probe)",
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3015\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"target_port_label": "3015 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3015"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|
|
|
TCP |
5174 · HTTP
|
http
|
file upload abuse
file upload abuse · via HTTP:5174 · (tentative d'exploit)
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950549:upload-0
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
5174
Chemin / cible
/
Pourquoi cette classification : Règle WAF « upload-0 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — 5 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Règles WAF
rce-0
rce-14
nosqli-3
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:5174
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:5174 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-ali
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "45cd2dc9ccddb99e6b4e3c5e97e74b55816fb624",
"http_host_hash": "8dc922d8d6593d9a5042b839e4382f09e4d853dc",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.627171446859042,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 5174,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.6,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "960658307a8d8384dfc5d0b942f4c75605c0fe43",
"event_fingerprint": "ab0cbebda4f61f9f6c3d139d859379aabe1b3849",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ce37be868859227ea4f6c38c9b89bbc0",
"payload_hash": "b2207363887adbb1806a3804e1a5815e",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5174,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3cbd36bd5f63301ad8202f7e9ac0bf1b8d7e312c",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 5174,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "file upload abuse \u00b7 via HTTP:5174 \u00b7 (tentative d'exploit)",
"target_port_label": "5174 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5174,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 5174,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "file upload abuse \u00b7 via HTTP:5174 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "5174 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5174"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface"
]
}
|
|
|
TCP |
5174 · HTTP
|
http
|
Sonde port 5174/TCP
port 5174 tcp · via HTTP:5174 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
HEAD / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
HEAD
/
TLS SNI
—
Capteur
paris-1
|
Méthode
HEAD
Port
5174
Chemin / cible
/
Preuve honeypot — Sonde port 5174/TCP
Connexion détectée sur le port 5174 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5174_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
HEAD / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
HEAD / HTTP/1.1
Host: 62.3.50.33:5174
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, zstd
Accept: */*
C
Requête brute (extrait)
HEAD / HTTP/1.1 Host: 62.3.50.33:5174 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "8dc922d8d6593d9a5042b839e4382f09e4d853dc",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "HEAD",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 153,
"payload_entropy": 5.133726242384823,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 5174,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "727d141b9eb4744f4a11492d54d22e91b06fbab9",
"event_fingerprint": "da9acc877265c027e9961e222d0f2269400d630a",
"classification_reason": "Type \u00ab port_5174_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "785eda009f439ca53af3f01cfae57c3e",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5174,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"evidence": {
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"classification_reason": "Type \u00ab port_5174_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4bf7f80ef8c63b512fe133a62cdedcbc12a1c694",
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 5174,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"attack_vector": "port 5174 tcp \u00b7 via HTTP:5174 \u00b7 (sonde \/ probe)",
"target_port_label": "5174 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_5174_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_5174_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5174,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 5174,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 5174 tcp \u00b7 via HTTP:5174 \u00b7 (sonde \/ probe)",
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5174\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"target_port_label": "5174 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5174"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|
|
|
TCP |
5173 · HTTP
|
http
|
file upload abuse
file upload abuse · via HTTP:5173 · (tentative d'exploit)
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950549:upload-0
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
5173
Chemin / cible
/
Pourquoi cette classification : Règle WAF « upload-0 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — 5 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Règles WAF
rce-0
rce-14
nosqli-3
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:5173
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-ali
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "45cd2dc9ccddb99e6b4e3c5e97e74b55816fb624",
"http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.622396253119344,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 5173,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "9f26a396d17ee8c5b5aa346b6cb1b1edf746c24a",
"event_fingerprint": "7fae14e7782ac8faadd7a341df61db0f2ce56f67",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ce37be868859227ea4f6c38c9b89bbc0",
"payload_hash": "fac94899a9a25f25b13557317a92a461",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5173,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e6e808e490b5fdde2aecbb113ec83c97cfa75b75",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 5173,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "file upload abuse \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit)",
"target_port_label": "5173 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5173,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 5173,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "file upload abuse \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "5173 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5173"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface"
]
}
|
|
|
TCP |
5173 · HTTP
|
http
|
Sonde port 5173/TCP
port 5173 tcp · via HTTP:5173 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
HEAD / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
HEAD
/
TLS SNI
—
Capteur
paris-1
|
Méthode
HEAD
Port
5173
Chemin / cible
/
Preuve honeypot — Sonde port 5173/TCP
Connexion détectée sur le port 5173 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_5173_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
HEAD / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
HEAD / HTTP/1.1
Host: 62.3.50.33:5173
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, zstd
Accept: */*
C
Requête brute (extrait)
HEAD / HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "HEAD",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 153,
"payload_entropy": 5.110133820983275,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 5173,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "e0c37515e41a8ed51feb4b8f6b569ffd60901754",
"event_fingerprint": "59eab4d94f29e4d2b7a7519f517ec3b43b0b639f",
"classification_reason": "Type \u00ab port_5173_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "9d48d25e6fc5c3e13b0ee0c25f871d88",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5173,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"evidence": {
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"classification_reason": "Type \u00ab port_5173_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a2c0e44f8897479e7b04665017743a1748db218e",
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 5173,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"attack_vector": "port 5173 tcp \u00b7 via HTTP:5173 \u00b7 (sonde \/ probe)",
"target_port_label": "5173 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_5173_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_5173_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5173,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 5173,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 5173 tcp \u00b7 via HTTP:5173 \u00b7 (sonde \/ probe)",
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"target_port_label": "5173 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5173"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|
|
|
TCP |
3008 · HTTP
|
http
|
file upload abuse
file upload abuse · via HTTP:3008 · (tentative d'exploit)
|
Élevée
|
Moyen · 56
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
28
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950549:upload-0
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
3008
Chemin / cible
/
Pourquoi cette classification : Règle WAF « upload-0 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 56
Confiance : Confiance 50 % — 5 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Règles WAF
rce-0
rce-14
nosqli-3
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3008
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3008 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-ali
Meta JSON brut
{
"http_header_count": 10,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "45cd2dc9ccddb99e6b4e3c5e97e74b55816fb624",
"http_host_hash": "991d32257aabf701a8437f82ca96da1787be0d5a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 463,
"payload_entropy": 5.6234338468077105,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3008,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 56,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "3b9ab4574964b7346695182d7567234c61b3b14c",
"event_fingerprint": "7cc6d580c6bcc780aa8a01a1775da210a0f1cea5",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 56
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ce37be868859227ea4f6c38c9b89bbc0",
"payload_hash": "fbd1d2b85f4cb13de2d586341a968261",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3008,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Assetnote\/1.0.0\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-ali",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "060caa4970b24fb780bbc3133893afd28dc85025",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"attack_vector": "file upload abuse \u00b7 via HTTP:3008 \u00b7 (tentative d'exploit)",
"target_port_label": "3008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab upload-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 56
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3008,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/60.0.3112.113 Safari\/537.36 Ass\u2026",
"port": 3008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "file upload abuse \u00b7 via HTTP:3008 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Ge",
"target_port_label": "3008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface"
]
}
|
|
|
TCP |
3008 · HTTP
|
http
|
Sonde port 3008/TCP
port 3008 tcp · via HTTP:3008 · (sonde / probe)
|
Élevée
|
Faible · 38
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
HEAD / UA python-requests/2.32.5
Émulateur
HTTP
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
http_ua_suspicious
Cible HTTP
HEAD
/
TLS SNI
—
Capteur
paris-1
|
Méthode
HEAD
Port
3008
Chemin / cible
/
Preuve honeypot — Sonde port 3008/TCP
Connexion détectée sur le port 3008 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_3008_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Risque capteur
Faible
· 38
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes · 2 tag(s) WAF
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
HEAD / HTTP/1.1
User-Agent
python-requests/2.32.5
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
HEAD / HTTP/1.1
Host: 62.3.50.33:3008
User-Agent: python-requests/2.32.5
Accept-Encoding: gzip, deflate, zstd
Accept: */*
C
Requête brute (extrait)
HEAD / HTTP/1.1 Host: 62.3.50.33:3008 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, zstd Accept: */* Connection: keep-alive
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "f343f9c1e6b4bd1214c9505270609d93a5a9cf43",
"http_host_hash": "991d32257aabf701a8437f82ca96da1787be0d5a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "HEAD",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 153,
"payload_entropy": 5.115067726226174,
"port_category": "registered",
"org": "Scaleway SAS",
"service": "http",
"app_proto": "http",
"asn": 12876,
"country": "FR",
"dst_port": 3008,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 20,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20
},
"risk_score": 38,
"tag_count": 4,
"anomaly_count": 1,
"campaign_key": "1010b84cb349471ead36fa68c4897bc8e421a329",
"event_fingerprint": "d3f843b5a074719b92ecc458fb57793a6b3c299d",
"classification_reason": "Type \u00ab port_3008_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 12876,
"org": "Scaleway SAS",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f712d38ba9b9c286c823406aa572410d",
"payload_hash": "10f8b2ac8cb71bc1bc707a587912d10f",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3008,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"evidence": {
"method": "HEAD",
"path": "\/",
"user_agent": "python-requests\/2.32.5",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "HEAD \/ HTTP\/1.1",
"request_sample": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"classification_reason": "Type \u00ab port_3008_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0aa98021faeeb61ec02b253d9aa8932c87b61f8b",
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"attack_vector": "port 3008 tcp \u00b7 via HTTP:3008 \u00b7 (sonde \/ probe)",
"target_port_label": "3008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_3008_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_3008_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
"confidence_pct": 55,
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 20,
"risk_score": 38
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3008,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "HEAD",
"http_path": "\/",
"request_line": "HEAD \/ HTTP\/1.1",
"http_user_agent": "python-requests\/2.32.5",
"port": 3008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 3008 tcp \u00b7 via HTTP:3008 \u00b7 (sonde \/ probe)",
"evidence_snippet": "HEAD \/ HTTP\/1.1\r\nHost: 62.3.50.33:3008\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, zstd\r\nAccept: *\/*\r\nC",
"target_port_label": "3008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"http_ua_suspicious",
"scanner-ua"
]
}
|