|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 433f20c75dca9de2
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� ���y.���@� � ����k�5C�| ����b�5 kS^ #uV�k#P\;� Y<j�R�$��IRe�S �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���y.���@� � ����k�5C�|
����b�5 kS^ #uV�k#P\;�
Y<j�R�$��IRe�S �,�+̩�0�/̨ � �
Requête brute (extrait)
� ���y.���@� � ����k�5C�| ����b�5 kS^ #uV�k#P\;� Y<j�R�$��IRe�S �,�+̩�0�/̨ � � http/1.1 - 3 & $ _� �rI�wv���!��T������ٽ�� + #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.91357968279557,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a16c1ddf6726353d8cc493031253564a",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "433f20c75dca9de2ea2bbd731450e662",
"ja4": "c7e7492389f40ecb6b58bde0f6589680",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "433f20c75dca9de2ea2bbd731450e662",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-5-16-13-23-45-51-43-11-35,29-23-24,0",
"tls_ja4_hash": "c7e7492389f40ecb6b58bde0f6589680",
"tls_ja4": "t13d0110_229c6129ad0d_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdy.\ufffd\ufffd\ufffd@\ufffd\u001e\ufffd\u001d\ufffd\ufffd\ufffd\ufffdk\ufffd5C\ufffd|\r\u0011\ufffd\ufffd\ufffd\ufffdb\ufffd5 kS^\u001e#uV\ufffdk#P\\;\ufffd\nY<j\ufffdR\u0019\ufffd$\ufffd\ufffdIRe\ufffdS\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdy.\ufffd\ufffd\ufffd@\ufffd\u001e\ufffd\u001d\ufffd\ufffd\ufffd\ufffdk\ufffd5C\ufffd|\r\u0011\ufffd\ufffd\ufffd\ufffdb\ufffd5 kS^\u001e#uV\ufffdk#P\\;\ufffd\nY<j\ufffdR\u0019\ufffd$\ufffd\ufffdIRe\ufffdS\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 _\ufffd\u0000\u0005\ufffdrI\ufffdwv\u0014\ufffd\u0004\ufffd\ufffd!\ufffd\ufffdT\ufffd\u0015\ufffd\ufffd\ufffd\ufffd\ufffd\u000e\u067d\ufffd\ufffd\u0015\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdy.\ufffd\ufffd\ufffd@\ufffd\u001e\ufffd\u001d\ufffd\ufffd\ufffd\ufffdk\ufffd5C\ufffd|\r\u0011\ufffd\ufffd\ufffd\ufffdb\ufffd5 kS^\u001e#uV\ufffdk#P\\;\ufffd\nY<j\ufffdR\u0019\ufffd$\ufffd\ufffdIRe\ufffdS\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2b66466a6c7f0f2eae072daf500c3260f768ce2",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdy.\ufffd\ufffd\ufffd@\ufffd\u001e\ufffd\u001d\ufffd\ufffd\ufffd\ufffdk\ufffd5C\ufffd|\r\u0011\ufffd\ufffd\ufffd\ufffdb\ufffd5 kS^\u001e#uV\ufffdk#P\\;\ufffd\nY<j\ufffdR\u0019\ufffd$\ufffd\ufffdIRe\ufffdS\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000",
"tls_ja3": "433f20c75dca9de2ea2bbd731450e662",
"tls_ja4": "c7e7492389f40ecb6b58bde0f6589680",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdy.\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd5C\ufffd|\r\ufffd\ufffd\ufffd\ufffdb\ufffd5 kS^#uV\ufffdk#P\\;\ufffd\nY<j\ufffdR\ufffd$\ufffd\ufffdIRe\ufffdS\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdy.\ufffd\ufffd\ufffd@\ufffd\u001e\ufffd\u001d\ufffd\ufffd\ufffd\ufffdk\ufffd5C\ufffd|\r\u0011\ufffd\ufffd\ufffd\ufffdb\ufffd5 kS^\u001e#uV\ufffdk#P\\;\ufffd\nY<j\ufffdR\u0019\ufffd$\ufffd\ufffdIRe\ufffdS\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000",
"tls_ja3": "433f20c75dca9de2ea2bbd731450e662",
"tls_ja4": "c7e7492389f40ecb6b58bde0f6589680",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffdy.\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd5C\ufffd|\r\ufffd\ufffd\ufffd\ufffdb\ufffd5 kS^#uV\ufffdk#P\\;\ufffd\nY<j\ufffdR\ufffd$\ufffd\ufffdIRe\ufffdS\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 023eee896dfb1ffa
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� �;&R��z߉뼑r���@�` ��"��.�� .�^K��>< GT=E�[��*���4N��� �,�+̩�0�/̨ � � -
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �;&R��z߉뼑r���@�` ��"��.�� .�^K��><
GT=E�[��*���4N��� �,�+̩�0�/̨ � �
-
Requête brute (extrait)
� �;&R��z߉뼑r���@�` ��"��.�� .�^K��>< GT=E�[��*���4N��� �,�+̩�0�/̨ � � - 3 & $ �D,�^n��ҧ�-�iY��8�8 ��8 v]� # + http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.908552650681045,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "86a8ad54078c752985f11819afab1e3c",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "023eee896dfb1ffa2fd5de7d5bbe18da",
"ja4": "2685c14151ba2c63e5a5b50b7d130bc1",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "023eee896dfb1ffa2fd5de7d5bbe18da",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-5-45-51-13-35-43-23-11-16,29-23-24,0",
"tls_ja4_hash": "2685c14151ba2c63e5a5b50b7d130bc1",
"tls_ja4": "t13d0110_82b2c80a6716_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u008e;&R\ufffd\ufffdz\u07c9\u0010\u0018\ubf11r\ufffd\ufffd\ufffd@\ufffd`\u001c\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffd .\ufffd^K\ufffd\u0013\ufffd><\nGT=E\ufffd[\ufffd\ufffd*\u001b\u0017\ufffd\ufffd\ufffd4\u000f\u000fN\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u008e;&R\ufffd\ufffdz\u07c9\u0010\u0018\ubf11r\ufffd\ufffd\ufffd@\ufffd`\u001c\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffd .\ufffd^K\ufffd\u0013\ufffd><\nGT=E\ufffd[\ufffd\ufffd*\u001b\u0017\ufffd\ufffd\ufffd4\u000f\u000fN\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdD,\ufffd^n\b\ufffd\ufffd\u04a7\ufffd-\ufffdiY\ufffd\ufffd8\ufffd8\u001e\ufffd\ufffd8\fv]\ufffd\u0011 \u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u008e;&R\ufffd\ufffdz\u07c9\u0010\u0018\ubf11r\ufffd\ufffd\ufffd@\ufffd`\u001c\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffd .\ufffd^K\ufffd\u0013\ufffd><\nGT=E\ufffd[\ufffd\ufffd*\u001b\u0017\ufffd\ufffd\ufffd4\u000f\u000fN\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9c0bfd79ec9a4e7cfab27b2215b46769c043049",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u008e;&R\ufffd\ufffdz\u07c9\u0010\u0018\ubf11r\ufffd\ufffd\ufffd@\ufffd`\u001c\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffd .\ufffd^K\ufffd\u0013\ufffd><\nGT=E\ufffd[\ufffd\ufffd*\u001b\u0017\ufffd\ufffd\ufffd4\u000f\u000fN\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001",
"tls_ja3": "023eee896dfb1ffa2fd5de7d5bbe18da",
"tls_ja4": "2685c14151ba2c63e5a5b50b7d130bc1",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd\u008e;&R\ufffd\ufffdz\u07c9\ubf11r\ufffd\ufffd\ufffd@\ufffd`\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffd .\ufffd^K\ufffd\ufffd><\nGT=E\ufffd[\ufffd\ufffd*\ufffd\ufffd\ufffd4N\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n-",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u008e;&R\ufffd\ufffdz\u07c9\u0010\u0018\ubf11r\ufffd\ufffd\ufffd@\ufffd`\u001c\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffd .\ufffd^K\ufffd\u0013\ufffd><\nGT=E\ufffd[\ufffd\ufffd*\u001b\u0017\ufffd\ufffd\ufffd4\u000f\u000fN\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001",
"tls_ja3": "023eee896dfb1ffa2fd5de7d5bbe18da",
"tls_ja4": "2685c14151ba2c63e5a5b50b7d130bc1",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\u008e;&R\ufffd\ufffdz\u07c9\ubf11r\ufffd\ufffd\ufffd@\ufffd`\ufffd\ufffd\"\ufffd\ufffd.\ufffd\ufffd .\ufffd^K\ufffd\ufffd><\nGT=E\ufffd[\ufffd\ufffd*\ufffd\ufffd\ufffd4N\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\n-",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 05d0ec9c6cbc4272
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� ��y��кG��B�?N�ܙm�i�w�#17��� �r ��J�s�����w�X��q���T��ޚ<= �,�+̩�0�/̨ � � +
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��y��кG��B�?N�ܙm�i�w�#17���
�r ��J�s�����w�X��q���T��ޚ<= �,�+̩�0�/̨ � � +
Requête brute (extrait)
� ��y��кG��B�?N�ܙm�i�w�#17��� �r ��J�s�����w�X��q���T��ޚ<= �,�+̩�0�/̨ � � + http/1.1 3 & $ �<a��� �� ���!���~[�ҽ �s~ - #
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.915915461929248,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3336ab3313a807f6db3962c6e44a7541",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "05d0ec9c6cbc4272675003af3f4d0cb5",
"ja4": "5b58f3064a19c187b942b92bee3e0c27",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "05d0ec9c6cbc4272675003af3f4d0cb5",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-43-5-16-10-51-45-11-13-35,29-23-24,0",
"tls_ja4_hash": "5b58f3064a19c187b942b92bee3e0c27",
"tls_ja4": "t13d0110_9644d914888b_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdy\ufffd\ufffd\u043aG\ufffd\ufffdB\ufffd?N\ufffd\u0719m\ufffdi\ufffdw\ufffd#17\ufffd\ufffd\ufffd\n\ufffdr \ufffd\ufffdJ\u0018\ufffds\ufffd\ufffd\ufffd\ufffd\u0011\ufffdw\ufffdX\ufffd\ufffdq\u001a\ufffd\ufffd\u000f\ufffdT\ufffd\u0018\ufffd\u001b\u079a<=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdy\ufffd\ufffd\u043aG\ufffd\ufffdB\ufffd?N\ufffd\u0719m\ufffdi\ufffdw\ufffd#17\ufffd\ufffd\ufffd\n\ufffdr \ufffd\ufffdJ\u0018\ufffds\ufffd\ufffd\ufffd\ufffd\u0011\ufffdw\ufffdX\ufffd\ufffdq\u001a\ufffd\ufffd\u000f\ufffdT\ufffd\u0018\ufffd\u001b\u079a<=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0013<a\ufffd\u0010\ufffd\u0013\ufffd\u001c\ufffd\ufffd\u0011\f\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd~[\u0016\ufffd\u04bd\u001d\ufffds~ \u0000-\u0000\u0002\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000#\u0000\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdy\ufffd\ufffd\u043aG\ufffd\ufffdB\ufffd?N\ufffd\u0719m\ufffdi\ufffdw\ufffd#17\ufffd\ufffd\ufffd\n\ufffdr \ufffd\ufffdJ\u0018\ufffds\ufffd\ufffd\ufffd\ufffd\u0011\ufffdw\ufffdX\ufffd\ufffdq\u001a\ufffd\ufffd\u000f\ufffdT\ufffd\u0018\ufffd\u001b\u079a<=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d1e2b900eb6c6e3e3a259ad5529aae745c30098",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdy\ufffd\ufffd\u043aG\ufffd\ufffdB\ufffd?N\ufffd\u0719m\ufffdi\ufffdw\ufffd#17\ufffd\ufffd\ufffd\n\ufffdr \ufffd\ufffdJ\u0018\ufffds\ufffd\ufffd\ufffd\ufffd\u0011\ufffdw\ufffdX\ufffd\ufffdq\u001a\ufffd\ufffd\u000f\ufffdT\ufffd\u0018\ufffd\u001b\u079a<=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000",
"tls_ja3": "05d0ec9c6cbc4272675003af3f4d0cb5",
"tls_ja4": "5b58f3064a19c187b942b92bee3e0c27",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd\ufffdy\ufffd\ufffd\u043aG\ufffd\ufffdB\ufffd?N\ufffd\u0719m\ufffdi\ufffdw\ufffd#17\ufffd\ufffd\ufffd\n\ufffdr \ufffd\ufffdJ\ufffds\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdX\ufffd\ufffdq\ufffd\ufffd\ufffdT\ufffd\ufffd\u079a<=\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdy\ufffd\ufffd\u043aG\ufffd\ufffdB\ufffd?N\ufffd\u0719m\ufffdi\ufffdw\ufffd#17\ufffd\ufffd\ufffd\n\ufffdr \ufffd\ufffdJ\u0018\ufffds\ufffd\ufffd\ufffd\ufffd\u0011\ufffdw\ufffdX\ufffd\ufffdq\u001a\ufffd\ufffd\u000f\ufffdT\ufffd\u0018\ufffd\u001b\u079a<=\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000",
"tls_ja3": "05d0ec9c6cbc4272675003af3f4d0cb5",
"tls_ja4": "5b58f3064a19c187b942b92bee3e0c27",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdy\ufffd\ufffd\u043aG\ufffd\ufffdB\ufffd?N\ufffd\u0719m\ufffdi\ufffdw\ufffd#17\ufffd\ufffd\ufffd\n\ufffdr \ufffd\ufffdJ\ufffds\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffdX\ufffd\ufffdq\ufffd\ufffd\ufffdT\ufffd\ufffd\u079a<=\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 6356c9769dd56378
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� �5U^"�6�S��jK.܁�ܥ�� � p � R ���EN#���^P�3����4�Fz��mF`o�96 �,�+̩�0�/̨ � � 3 & $ ���^˺ ��f"�
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �5U^"�6�S��jK.܁�ܥ�� � p �
R ���EN#���^P�3����4�Fz��mF`o�96 �,�+̩�0�/̨ � � 3 & $ ���^˺ ��f"�
Requête brute (extrait)
� �5U^"�6�S��jK.܁�ܥ�� � p � R ���EN#���^P�3����4�Fz��mF`o�96 �,�+̩�0�/̨ � � 3 & $ ���^˺ ��f"�9awAwEb���ԗ�ol + http/1.1 # -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.90089129497615,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4b71f83fc29746d84680fe2f3b3b681e",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "6356c9769dd5637829414552cf194784",
"ja4": "2329a49874cb72ea453845c3ff092c58",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "6356c9769dd5637829414552cf194784",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-13-43-23-16-11-35-5-45-10,29-23-24,0",
"tls_ja4_hash": "2329a49874cb72ea453845c3ff092c58",
"tls_ja4": "t13d0110_8762e46a7e14_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035U^\u0014\"\ufffd6\ufffdS\u001a\ufffd\ufffdjK.\u0701\u0003\ufffd\u0725\ufffd\ufffd\t\ufffd\fp\u000b\ufffd\nR \ufffd\ufffd\ufffdEN#\ufffd\ufffd\ufffd^P\ufffd3\ufffd\ufffd\ufffd\ufffd4\u0018\ufffdFz\ufffd\ufffdmF`o\ufffd\u000e96\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\b\ufffd^\u02fa\f\u001b\ufffd\ufffd\u000ef\"\ufffd\u0007",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035U^\u0014\"\ufffd6\ufffdS\u001a\ufffd\ufffdjK.\u0701\u0003\ufffd\u0725\ufffd\ufffd\t\ufffd\fp\u000b\ufffd\nR \ufffd\ufffd\ufffdEN#\ufffd\ufffd\ufffd^P\ufffd3\ufffd\ufffd\ufffd\ufffd4\u0018\ufffdFz\ufffd\ufffdmF`o\ufffd\u000e96\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\b\ufffd^\u02fa\f\u001b\ufffd\ufffd\u000ef\"\ufffd\u00079awAwEb\ufffd\ufffd\ufffd\u0517\ufffdol\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035U^\u0014\"\ufffd6\ufffdS\u001a\ufffd\ufffdjK.\u0701\u0003\ufffd\u0725\ufffd\ufffd\t\ufffd\fp\u000b\ufffd\nR \ufffd\ufffd\ufffdEN#\ufffd\ufffd\ufffd^P\ufffd3\ufffd\ufffd\ufffd\ufffd4\u0018\ufffdFz\ufffd\ufffdmF`o\ufffd\u000e96\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\b\ufffd^\u02fa\f\u001b\ufffd\ufffd\u000ef\"\ufffd\u0007",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "57e82293dda47751a7dce2f9e95df25ac937d702",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035U^\u0014\"\ufffd6\ufffdS\u001a\ufffd\ufffdjK.\u0701\u0003\ufffd\u0725\ufffd\ufffd\t\ufffd\fp\u000b\ufffd\nR \ufffd\ufffd\ufffdEN#\ufffd\ufffd\ufffd^P\ufffd3\ufffd\ufffd\ufffd\ufffd4\u0018\ufffdFz\ufffd\ufffdmF`o\ufffd\u000e96\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\b\ufffd^\u02fa\f\u001b\ufffd\ufffd\u000ef\"\ufffd\u0007",
"tls_ja3": "6356c9769dd5637829414552cf194784",
"tls_ja4": "2329a49874cb72ea453845c3ff092c58",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd5U^\"\ufffd6\ufffdS\ufffd\ufffdjK.\u0701\ufffd\u0725\ufffd\ufffd\t\ufffdp\ufffd\nR \ufffd\ufffd\ufffdEN#\ufffd\ufffd\ufffd^P\ufffd3\ufffd\ufffd\ufffd\ufffd4\ufffdFz\ufffd\ufffdmF`o\ufffd96\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd\ufffd\ufffd^\u02fa\ufffd\ufffdf\"\ufffd",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00035U^\u0014\"\ufffd6\ufffdS\u001a\ufffd\ufffdjK.\u0701\u0003\ufffd\u0725\ufffd\ufffd\t\ufffd\fp\u000b\ufffd\nR \ufffd\ufffd\ufffdEN#\ufffd\ufffd\ufffd^P\ufffd3\ufffd\ufffd\ufffd\ufffd4\u0018\ufffdFz\ufffd\ufffdmF`o\ufffd\u000e96\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\b\ufffd^\u02fa\f\u001b\ufffd\ufffd\u000ef\"\ufffd\u0007",
"tls_ja3": "6356c9769dd5637829414552cf194784",
"tls_ja4": "2329a49874cb72ea453845c3ff092c58",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd5U^\"\ufffd6\ufffdS\ufffd\ufffdjK.\u0701\ufffd\u0725\ufffd\ufffd\t\ufffdp\ufffd\nR \ufffd\ufffd\ufffdEN#\ufffd\ufffd\ufffd^P\ufffd3\ufffd\ufffd\ufffd\ufffd4\ufffdFz\ufffd\ufffdmF`o\ufffd96\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd\ufffd\ufffd^\u02fa\ufffd\ufffdf\"\ufffd",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
Sonde PostgreSQL
postgres probe · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 88426f3584db9a51
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� ��mf�Zts��B��1R�hf2}!J��\m�� D}� ߆�X�˘��ab] B��-� 6�K�Җ��Ʃ �,�+̩�0�/̨ � � 3 & $ � ~��˲��!~3J�
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��mf�Zts��B��1R�hf2}!J��\m�� D}� ߆�X�˘��ab] B��-� 6�K�Җ��Ʃ �,�+̩�0�/̨ � � 3 & $ � ~��˲��!~3J�
Requête brute (extrait)
� ��mf�Zts��B��1R�hf2}!J��\m�� D}� ߆�X�˘��ab] B��-� 6�K�Җ��Ʃ �,�+̩�0�/̨ � � 3 & $ � ~��˲��!~3J��������u< F�t��+ # - + http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.8368225408146435,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "splunk",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e2caaa17e7772eeee7ea3dfa8207a8e9",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "88426f3584db9a513789fb772db05470",
"ja4": "17356c707431aca2d534a2848fed09dc",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "88426f3584db9a513789fb772db05470",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-35-13-11-23-45-5-10-43-16,29-23-24,0",
"tls_ja4_hash": "17356c707431aca2d534a2848fed09dc",
"tls_ja4": "t13d0110_4be30bed986c_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdmf\ufffdZts\ufffd\ufffdB\ufffd\ufffd1R\ufffdhf2}!J\ufffd\ufffd\\m\ufffd\ufffd\u000bD}\u0005\ufffd \u0011\u07c6\ufffdX\ufffd\u02d8\ufffd\ufffda\u0011b]\u001cB\ufffd\ufffd\u000e-\ufffd\t6\ufffdK\ufffd\u0496\ufffd\ufffd\u01a9\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\t~\ufffd\ufffd\b\u02f2\ufffd\ufffd!~3J\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdmf\ufffdZts\ufffd\ufffdB\ufffd\ufffd1R\ufffdhf2}!J\ufffd\ufffd\\m\ufffd\ufffd\u000bD}\u0005\ufffd \u0011\u07c6\ufffdX\ufffd\u02d8\ufffd\ufffda\u0011b]\u001cB\ufffd\ufffd\u000e-\ufffd\t6\ufffdK\ufffd\u0496\ufffd\ufffd\u01a9\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\t~\ufffd\ufffd\b\u02f2\ufffd\ufffd!~3J\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu<\fF\ufffdt\ufffd\ufffd+\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdmf\ufffdZts\ufffd\ufffdB\ufffd\ufffd1R\ufffdhf2}!J\ufffd\ufffd\\m\ufffd\ufffd\u000bD}\u0005\ufffd \u0011\u07c6\ufffdX\ufffd\u02d8\ufffd\ufffda\u0011b]\u001cB\ufffd\ufffd\u000e-\ufffd\t6\ufffdK\ufffd\u0496\ufffd\ufffd\u01a9\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\t~\ufffd\ufffd\b\u02f2\ufffd\ufffd!~3J\ufffd",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39f68d86fa60a291fe5b70676acd906d566bd365",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdmf\ufffdZts\ufffd\ufffdB\ufffd\ufffd1R\ufffdhf2}!J\ufffd\ufffd\\m\ufffd\ufffd\u000bD}\u0005\ufffd \u0011\u07c6\ufffdX\ufffd\u02d8\ufffd\ufffda\u0011b]\u001cB\ufffd\ufffd\u000e-\ufffd\t6\ufffdK\ufffd\u0496\ufffd\ufffd\u01a9\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\t~\ufffd\ufffd\b\u02f2\ufffd\ufffd!~3J\ufffd",
"tls_ja3": "88426f3584db9a513789fb772db05470",
"tls_ja4": "17356c707431aca2d534a2848fed09dc",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd\ufffdmf\ufffdZts\ufffd\ufffdB\ufffd\ufffd1R\ufffdhf2}!J\ufffd\ufffd\\m\ufffd\ufffdD}\ufffd \u07c6\ufffdX\ufffd\u02d8\ufffd\ufffdab]B\ufffd\ufffd-\ufffd\t6\ufffdK\ufffd\u0496\ufffd\ufffd\u01a9\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd\t~\ufffd\ufffd\u02f2\ufffd\ufffd!~3J\ufffd",
"attack_vector": "postgres probe \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdmf\ufffdZts\ufffd\ufffdB\ufffd\ufffd1R\ufffdhf2}!J\ufffd\ufffd\\m\ufffd\ufffd\u000bD}\u0005\ufffd \u0011\u07c6\ufffdX\ufffd\u02d8\ufffd\ufffda\u0011b]\u001cB\ufffd\ufffd\u000e-\ufffd\t6\ufffdK\ufffd\u0496\ufffd\ufffd\u01a9\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\t~\ufffd\ufffd\b\u02f2\ufffd\ufffd!~3J\ufffd",
"tls_ja3": "88426f3584db9a513789fb772db05470",
"tls_ja4": "17356c707431aca2d534a2848fed09dc",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "postgres probe \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdmf\ufffdZts\ufffd\ufffdB\ufffd\ufffd1R\ufffdhf2}!J\ufffd\ufffd\\m\ufffd\ufffdD}\ufffd \u07c6\ufffdX\ufffd\u02d8\ufffd\ufffdab]B\ufffd\ufffd-\ufffd\t6\ufffdK\ufffd\u0496\ufffd\ufffd\u01a9\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3&$ \ufffd\t~\ufffd\ufffd\u02f2\ufffd\ufffd!~3J\ufffd",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 3fb74aa426cf4fd0
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� �Q�`50,��3�ˠ ;H 8^��� �KA�~�QI Y'� Д���2� B����BFr � �,�+̩�0�/̨ � � #
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Q�`50,��3�ˠ ;H 8^��� �KA�~�QI Y'� Д���2� B����BFr
� �,�+̩�0�/̨ � � #
Requête brute (extrait)
� �Q�`50,��3�ˠ ;H 8^��� �KA�~�QI Y'� Д���2� B����BFr � �,�+̩�0�/̨ � � # - 3 & $ �4�"ԍ�g�b}Cf�Q��m�J) ̠o>ipY q + http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.86448234254262,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "20fe7f46f011a425c2320d33f22a6e23",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "3fb74aa426cf4fd0daf024ce2a36b210",
"ja4": "68a7ec35e4b0408a641cdb3e78e1b39a",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "3fb74aa426cf4fd0daf024ce2a36b210",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-35-13-11-45-51-43-23-16-10,29-23-24,0",
"tls_ja4_hash": "68a7ec35e4b0408a641cdb3e78e1b39a",
"tls_ja4": "t13d0110_ae24de8a5cc8_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\ufffd`50,\ufffd\ufffd3\ufffd\u02e0\u000b;H\u00008^\ufffd\ufffd\ufffd\u000b\ufffd\u0010KA\ufffd~\ufffdQI \u000b\u0002Y'\ufffd\t\u0011\u001c\u0414\ufffd\ufffd\ufffd2\ufffd\u001fB\ufffd\ufffd\ufffd\u0018\ufffdBF\udba1\ude2d\u0010r\r\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\ufffd`50,\ufffd\ufffd3\ufffd\u02e0\u000b;H\u00008^\ufffd\ufffd\ufffd\u000b\ufffd\u0010KA\ufffd~\ufffdQI \u000b\u0002Y'\ufffd\t\u0011\u001c\u0414\ufffd\ufffd\ufffd2\ufffd\u001fB\ufffd\ufffd\ufffd\u0018\ufffdBF\udba1\ude2d\u0010r\r\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd4\ufffd\"\u050d\ufffdg\ufffdb}Cf\ufffdQ\ufffd\u0011\ufffdm\ufffdJ)\u001d\u0320o>ipY\rq\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\ufffd`50,\ufffd\ufffd3\ufffd\u02e0\u000b;H\u00008^\ufffd\ufffd\ufffd\u000b\ufffd\u0010KA\ufffd~\ufffdQI \u000b\u0002Y'\ufffd\t\u0011\u001c\u0414\ufffd\ufffd\ufffd2\ufffd\u001fB\ufffd\ufffd\ufffd\u0018\ufffdBF\udba1\ude2d\u0010r\r\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb574490e5763b1c0407f97489c59091e45b2734",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\ufffd`50,\ufffd\ufffd3\ufffd\u02e0\u000b;H\u00008^\ufffd\ufffd\ufffd\u000b\ufffd\u0010KA\ufffd~\ufffdQI \u000b\u0002Y'\ufffd\t\u0011\u001c\u0414\ufffd\ufffd\ufffd2\ufffd\u001fB\ufffd\ufffd\ufffd\u0018\ufffdBF\udba1\ude2d\u0010r\r\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004",
"tls_ja3": "3fb74aa426cf4fd0daf024ce2a36b210",
"tls_ja4": "68a7ec35e4b0408a641cdb3e78e1b39a",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffdQ\ufffd`50,\ufffd\ufffd3\ufffd\u02e0;H8^\ufffd\ufffd\ufffd\ufffdKA\ufffd~\ufffdQI Y'\ufffd\t\u0414\ufffd\ufffd\ufffd2\ufffdB\ufffd\ufffd\ufffd\ufffdBF\udba1\ude2dr\r\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Q\ufffd`50,\ufffd\ufffd3\ufffd\u02e0\u000b;H\u00008^\ufffd\ufffd\ufffd\u000b\ufffd\u0010KA\ufffd~\ufffdQI \u000b\u0002Y'\ufffd\t\u0011\u001c\u0414\ufffd\ufffd\ufffd2\ufffd\u001fB\ufffd\ufffd\ufffd\u0018\ufffdBF\udba1\ude2d\u0010r\r\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004",
"tls_ja3": "3fb74aa426cf4fd0daf024ce2a36b210",
"tls_ja4": "68a7ec35e4b0408a641cdb3e78e1b39a",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdQ\ufffd`50,\ufffd\ufffd3\ufffd\u02e0;H8^\ufffd\ufffd\ufffd\ufffdKA\ufffd~\ufffdQI Y'\ufffd\t\u0414\ufffd\ufffd\ufffd2\ufffdB\ufffd\ufffd\ufffd\ufffdBF\udba1\ude2dr\r\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a22594183a3f457d
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� �]��F�(�Oʜ��:.搋ƨ�#�t:�I�ȱ M�蟛�U �a�^H'���yuC] ����$Ô �,�+̩�0�/̨ � � - 3 & $ _�Wa��N
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �]��F�(�Oʜ��:.搋ƨ�#�t:�I�ȱ M�蟛�U �a�^H'���yuC] ����$Ô �,�+̩�0�/̨ � � - 3 & $ _�Wa��N
Requête brute (extrait)
� �]��F�(�Oʜ��:.搋ƨ�#�t:�I�ȱ M�蟛�U �a�^H'���yuC] ����$Ô �,�+̩�0�/̨ � � - 3 & $ _�Wa��N�}+��T��xA '�ޱ�2��Q26 + # http/1.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.870378544783913,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "db028eb80b2af8894b3c41ffd4c74c34",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "a22594183a3f457d82a8c44c5da2b926",
"ja4": "4e105384820e49b3abf166d4f7ef5550",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "a22594183a3f457d82a8c44c5da2b926",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-51-10-43-5-23-11-35-16-13,29-23-24,0",
"tls_ja4_hash": "4e105384820e49b3abf166d4f7ef5550",
"tls_ja4": "t13d0110_2c3d973e54dd_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003]\u0014\ufffd\ufffdF\ufffd(\ufffdO\u029c\ufffd\ufffd:\u0005.\u640b\u01a8\ufffd#\ufffdt:\ufffdI\ufffd\u0231 M\ufffd\u87db\ufffdU\u0003\u0003\f\ufffda\ufffd^H'\ufffd\ufffd\ufffdyuC]\u001f\ufffd\ufffd\ufffd\ufffd$\u0019\u00d4\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000b_\ufffdWa\u0002\ufffd\ufffdN",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003]\u0014\ufffd\ufffdF\ufffd(\ufffdO\u029c\ufffd\ufffd:\u0005.\u640b\u01a8\ufffd#\ufffdt:\ufffdI\ufffd\u0231 M\ufffd\u87db\ufffdU\u0003\u0003\f\ufffda\ufffd^H'\ufffd\ufffd\ufffdyuC]\u001f\ufffd\ufffd\ufffd\ufffd$\u0019\u00d4\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000b_\ufffdWa\u0002\ufffd\ufffdN\ufffd}+\ufffd\ufffdT\ufffd\ufffdxA\u000b'\ufffd\u07b1\ufffd2\ufffd\ufffdQ26\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003]\u0014\ufffd\ufffdF\ufffd(\ufffdO\u029c\ufffd\ufffd:\u0005.\u640b\u01a8\ufffd#\ufffdt:\ufffdI\ufffd\u0231 M\ufffd\u87db\ufffdU\u0003\u0003\f\ufffda\ufffd^H'\ufffd\ufffd\ufffdyuC]\u001f\ufffd\ufffd\ufffd\ufffd$\u0019\u00d4\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000b_\ufffdWa\u0002\ufffd\ufffdN",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e1cb209efd2ad727040c010000e31d47fb660257",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003]\u0014\ufffd\ufffdF\ufffd(\ufffdO\u029c\ufffd\ufffd:\u0005.\u640b\u01a8\ufffd#\ufffdt:\ufffdI\ufffd\u0231 M\ufffd\u87db\ufffdU\u0003\u0003\f\ufffda\ufffd^H'\ufffd\ufffd\ufffdyuC]\u001f\ufffd\ufffd\ufffd\ufffd$\u0019\u00d4\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000b_\ufffdWa\u0002\ufffd\ufffdN",
"tls_ja3": "a22594183a3f457d82a8c44c5da2b926",
"tls_ja4": "4e105384820e49b3abf166d4f7ef5550",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd]\ufffd\ufffdF\ufffd(\ufffdO\u029c\ufffd\ufffd:.\u640b\u01a8\ufffd#\ufffdt:\ufffdI\ufffd\u0231 M\ufffd\u87db\ufffdU\ufffda\ufffd^H'\ufffd\ufffd\ufffdyuC]\ufffd\ufffd\ufffd\ufffd$\u00d4\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3&$ _\ufffdWa\ufffd\ufffdN",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003]\u0014\ufffd\ufffdF\ufffd(\ufffdO\u029c\ufffd\ufffd:\u0005.\u640b\u01a8\ufffd#\ufffdt:\ufffdI\ufffd\u0231 M\ufffd\u87db\ufffdU\u0003\u0003\f\ufffda\ufffd^H'\ufffd\ufffd\ufffdyuC]\u001f\ufffd\ufffd\ufffd\ufffd$\u0019\u00d4\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000b_\ufffdWa\u0002\ufffd\ufffdN",
"tls_ja3": "a22594183a3f457d82a8c44c5da2b926",
"tls_ja4": "4e105384820e49b3abf166d4f7ef5550",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd]\ufffd\ufffdF\ufffd(\ufffdO\u029c\ufffd\ufffd:.\u640b\u01a8\ufffd#\ufffdt:\ufffdI\ufffd\u0231 M\ufffd\u87db\ufffdU\ufffda\ufffd^H'\ufffd\ufffd\ufffdyuC]\ufffd\ufffd\ufffd\ufffd$\u00d4\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3&$ _\ufffdWa\ufffd\ufffdN",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
Sonde PostgreSQL
postgres probe · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 a5055fd4a38d1ee2
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� ��� n��9uy���ڻ�* �'��)�M��.;�� �ȷ� ��� :A�7 �"�>�n��[w�B`�� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���
n��9uy���ڻ�*
�'��)�M��.;�� �ȷ� ��� :A�7 �"�>�n��[w�B`�� �,�+̩�0�/̨ � �
Requête brute (extrait)
� ��� n��9uy���ڻ�* �'��)�M��.;�� �ȷ� ��� :A�7 �"�>�n��[w�B`�� �,�+̩�0�/̨ � � 3 & $ ʃ�D��{�m�{@{����,��Ĝ?��P�5 # + http/1.1 -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.911577779117558,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "splunk",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "579eac4857f9a374c8a006ce90695c47",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
"ja3": "a5055fd4a38d1ee201fb51e61e9f2db4",
"ja4": "dbd81c4fa777088782aa93bad001eb5a",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "a5055fd4a38d1ee201fb51e61e9f2db4",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-51-11-35-43-23-5-10-16-45,29-23-24,0",
"tls_ja4_hash": "dbd81c4fa777088782aa93bad001eb5a",
"tls_ja4": "t13d0110_a99a1a00d69e_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\rn\ufffd\u0007\ufffd9uy\ufffd\ufffd\ufffd\u06bb\ufffd*\r\ufffd\u0019'\ufffd\ufffd)\ufffdM\ufffd\ufffd.;\ufffd\ufffd \ufffd\u0237\ufffd\t\ufffd\ufffd\ufffd\t:A\ufffd7\u001f\u001c\ufffd\"\ufffd>\ufffd\u0010n\ufffd\ufffd[w\ufffdB`\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\rn\ufffd\u0007\ufffd9uy\ufffd\ufffd\ufffd\u06bb\ufffd*\r\ufffd\u0019'\ufffd\ufffd)\ufffdM\ufffd\ufffd.;\ufffd\ufffd \ufffd\u0237\ufffd\t\ufffd\ufffd\ufffd\t:A\ufffd7\u001f\u001c\ufffd\"\ufffd>\ufffd\u0010n\ufffd\ufffd[w\ufffdB`\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0283\ufffdD\ufffd\ufffd\u0016{\ufffdm\ufffd{@{\ufffd\ufffd\u0002\ufffd\ufffd,\ufffd\u0018\u001a\ufffd\u011c?\ufffd\ufffdP\ufffd5\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\rn\ufffd\u0007\ufffd9uy\ufffd\ufffd\ufffd\u06bb\ufffd*\r\ufffd\u0019'\ufffd\ufffd)\ufffdM\ufffd\ufffd.;\ufffd\ufffd \ufffd\u0237\ufffd\t\ufffd\ufffd\ufffd\t:A\ufffd7\u001f\u001c\ufffd\"\ufffd>\ufffd\u0010n\ufffd\ufffd[w\ufffdB`\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eece460b27dd8945e3be83258fce78ac608c152c",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\rn\ufffd\u0007\ufffd9uy\ufffd\ufffd\ufffd\u06bb\ufffd*\r\ufffd\u0019'\ufffd\ufffd)\ufffdM\ufffd\ufffd.;\ufffd\ufffd \ufffd\u0237\ufffd\t\ufffd\ufffd\ufffd\t:A\ufffd7\u001f\u001c\ufffd\"\ufffd>\ufffd\u0010n\ufffd\ufffd[w\ufffdB`\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "a5055fd4a38d1ee201fb51e61e9f2db4",
"tls_ja4": "dbd81c4fa777088782aa93bad001eb5a",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\rn\ufffd\ufffd9uy\ufffd\ufffd\ufffd\u06bb\ufffd*\r\ufffd'\ufffd\ufffd)\ufffdM\ufffd\ufffd.;\ufffd\ufffd \ufffd\u0237\ufffd\t\ufffd\ufffd\ufffd\t:A\ufffd7\ufffd\"\ufffd>\ufffdn\ufffd\ufffd[w\ufffdB`\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\rn\ufffd\u0007\ufffd9uy\ufffd\ufffd\ufffd\u06bb\ufffd*\r\ufffd\u0019'\ufffd\ufffd)\ufffdM\ufffd\ufffd.;\ufffd\ufffd \ufffd\u0237\ufffd\t\ufffd\ufffd\ufffd\t:A\ufffd7\u001f\u001c\ufffd\"\ufffd>\ufffd\u0010n\ufffd\ufffd[w\ufffdB`\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "a5055fd4a38d1ee201fb51e61e9f2db4",
"tls_ja4": "dbd81c4fa777088782aa93bad001eb5a",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "postgres probe \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\rn\ufffd\ufffd9uy\ufffd\ufffd\ufffd\u06bb\ufffd*\r\ufffd'\ufffd\ufffd)\ufffdM\ufffd\ufffd.;\ufffd\ufffd \ufffd\u0237\ufffd\t\ufffd\ufffd\ufffd\t:A\ufffd7\ufffd\"\ufffd>\ufffdn\ufffd\ufffd[w\ufffdB`\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 f051ac7515c93018
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� ��TH�� ~�����7�Ϲtd�0�.���_QtdŞ FX�֬tuO}�_� �� �J�9GX�U8��� �,�+̩�0�/̨ � � - http/1.1 #
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��TH�� ~�����7�Ϲtd�0�.���_QtdŞ FX�֬tuO}�_� �� �J�9GX�U8��� �,�+̩�0�/̨ � � - http/1.1 #
Requête brute (extrait)
� ��TH�� ~�����7�Ϲtd�0�.���_QtdŞ FX�֬tuO}�_� �� �J�9GX�U8��� �,�+̩�0�/̨ � � - http/1.1 # + 3 & $ p��C�|��"ڂ�(L % >;��T��}�I��a
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.897068185885695,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1ac20012e47b8303e0b4fb57ea267827",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "f051ac7515c93018df62ac4f502940b4",
"ja4": "4d40e79dfce7b172670cfded5bf3b89b",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "f051ac7515c93018df62ac4f502940b4",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-16-35-23-43-51-10-11-5-13,29-23-24,0",
"tls_ja4_hash": "4d40e79dfce7b172670cfded5bf3b89b",
"tls_ja4": "t13d0110_316e5eb4b01e_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTH\ufffd\ufffd\f~\ufffd\ufffd\ufffd\u0017\ufffd\ufffd7\ufffd\u03f9td\ufffd0\ufffd.\ufffd\ufffd\ufffd_Qtd\u015e FX\ufffd\u05act\u001buO\u0001}\ufffd_\ufffd\u001e\ufffd\ufffd\u000b\ufffdJ\u0011\u0011\ufffd9GX\ufffdU8\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTH\ufffd\ufffd\f~\ufffd\ufffd\ufffd\u0017\ufffd\ufffd7\ufffd\u03f9td\ufffd0\ufffd.\ufffd\ufffd\ufffd_Qtd\u015e FX\ufffd\u05act\u001buO\u0001}\ufffd_\ufffd\u001e\ufffd\ufffd\u000b\ufffdJ\u0011\u0011\ufffd9GX\ufffdU8\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 p\ufffd\ufffdC\u0003\ufffd|\u001b\ufffd\ufffd\"\u0682\ufffd(L\u001f%\u001e>;\ufffd\ufffdT\ufffd\ufffd}\ufffdI\ufffd\ufffda\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTH\ufffd\ufffd\f~\ufffd\ufffd\ufffd\u0017\ufffd\ufffd7\ufffd\u03f9td\ufffd0\ufffd.\ufffd\ufffd\ufffd_Qtd\u015e FX\ufffd\u05act\u001buO\u0001}\ufffd_\ufffd\u001e\ufffd\ufffd\u000b\ufffdJ\u0011\u0011\ufffd9GX\ufffdU8\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "decf6b597c4daedd5df18cb574bdf46467a78cd9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTH\ufffd\ufffd\f~\ufffd\ufffd\ufffd\u0017\ufffd\ufffd7\ufffd\u03f9td\ufffd0\ufffd.\ufffd\ufffd\ufffd_Qtd\u015e FX\ufffd\u05act\u001buO\u0001}\ufffd_\ufffd\u001e\ufffd\ufffd\u000b\ufffdJ\u0011\u0011\ufffd9GX\ufffdU8\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000",
"tls_ja3": "f051ac7515c93018df62ac4f502940b4",
"tls_ja4": "4d40e79dfce7b172670cfded5bf3b89b",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd\ufffdTH\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\u03f9td\ufffd0\ufffd.\ufffd\ufffd\ufffd_Qtd\u015e FX\ufffd\u05actuO}\ufffd_\ufffd\ufffd\ufffd\ufffdJ\ufffd9GX\ufffdU8\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\thttp\/1.1#",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdTH\ufffd\ufffd\f~\ufffd\ufffd\ufffd\u0017\ufffd\ufffd7\ufffd\u03f9td\ufffd0\ufffd.\ufffd\ufffd\ufffd_Qtd\u015e FX\ufffd\u05act\u001buO\u0001}\ufffd_\ufffd\u001e\ufffd\ufffd\u000b\ufffdJ\u0011\u0011\ufffd9GX\ufffdU8\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000#\u0000\u0000\u0000",
"tls_ja3": "f051ac7515c93018df62ac4f502940b4",
"tls_ja4": "4d40e79dfce7b172670cfded5bf3b89b",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdTH\ufffd\ufffd~\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\u03f9td\ufffd0\ufffd.\ufffd\ufffd\ufffd_Qtd\u015e FX\ufffd\u05actuO}\ufffd_\ufffd\ufffd\ufffd\ufffdJ\ufffd9GX\ufffdU8\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\thttp\/1.1#",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 09b2fbcd2385bd2d
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� �~��@h�4>���T�L �S�M0��RD�hJ�� �� \t�̀h�$7G��d��qq�����a(� �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �~��@h�4>���T�L �S�M0��RD�hJ�� �� \t�̀h�$7G��d��qq�����a(� �,�+̩�0�/̨ � �
Requête brute (extrait)
� �~��@h�4>���T�L �S�M0��RD�hJ�� �� \t�̀h�$7G��d��qq�����a(� �,�+̩�0�/̨ � � # http/1.1 - 3 & $ ��ˬ!��)��`&vz��^7�gv__ =�~+K +
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.9003952970324685,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3298b21cceef822426f75dc50f2b55bd",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "09b2fbcd2385bd2df902f056c4f0c7f9",
"ja4": "e8816d96498378b78a33c72415cadd50",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "09b2fbcd2385bd2df902f056c4f0c7f9",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-5-35-16-45-51-43-10-23-11,29-23-24,0",
"tls_ja4_hash": "e8816d96498378b78a33c72415cadd50",
"tls_ja4": "t13d0110_c89f73f7bb98_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffd\ufffd@h\ufffd4\u001b>\ufffd\ufffd\ufffdT\ufffdL\b\u001c\ufffdS\ufffdM0\ufffd\ufffdRD\ufffdhJ\ufffd\ufffd \ufffd\ufffd\u001e\u000b\\t\ufffd\u0340h\ufffd$7G\ufffd\ufffdd\ufffd\ufffdqq\ufffd\ufffd\u0011\ufffd\ufffd\ufffda(\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffd\ufffd@h\ufffd4\u001b>\ufffd\ufffd\ufffdT\ufffdL\b\u001c\ufffdS\ufffdM0\ufffd\ufffdRD\ufffdhJ\ufffd\ufffd \ufffd\ufffd\u001e\u000b\\t\ufffd\u0340h\ufffd$7G\ufffd\ufffdd\ufffd\ufffdqq\ufffd\ufffd\u0011\ufffd\ufffd\ufffda(\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u02ec!\ufffd\ufffd)\ufffd\ufffd`&vz\ufffd\ufffd^7\ufffdgv__\u0000\u0011=\u000f\ufffd~+\bK\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffd\ufffd@h\ufffd4\u001b>\ufffd\ufffd\ufffdT\ufffdL\b\u001c\ufffdS\ufffdM0\ufffd\ufffdRD\ufffdhJ\ufffd\ufffd \ufffd\ufffd\u001e\u000b\\t\ufffd\u0340h\ufffd$7G\ufffd\ufffdd\ufffd\ufffdqq\ufffd\ufffd\u0011\ufffd\ufffd\ufffda(\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "543adab6c5020e1027c9f6c272cee59f14b70a0e",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffd\ufffd@h\ufffd4\u001b>\ufffd\ufffd\ufffdT\ufffdL\b\u001c\ufffdS\ufffdM0\ufffd\ufffdRD\ufffdhJ\ufffd\ufffd \ufffd\ufffd\u001e\u000b\\t\ufffd\u0340h\ufffd$7G\ufffd\ufffdd\ufffd\ufffdqq\ufffd\ufffd\u0011\ufffd\ufffd\ufffda(\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "09b2fbcd2385bd2df902f056c4f0c7f9",
"tls_ja4": "e8816d96498378b78a33c72415cadd50",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd~\ufffd\ufffd@h\ufffd4>\ufffd\ufffd\ufffdT\ufffdL\ufffdS\ufffdM0\ufffd\ufffdRD\ufffdhJ\ufffd\ufffd \ufffd\ufffd\\t\ufffd\u0340h\ufffd$7G\ufffd\ufffdd\ufffd\ufffdqq\ufffd\ufffd\ufffd\ufffd\ufffda(\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~\ufffd\ufffd@h\ufffd4\u001b>\ufffd\ufffd\ufffdT\ufffdL\b\u001c\ufffdS\ufffdM0\ufffd\ufffdRD\ufffdhJ\ufffd\ufffd \ufffd\ufffd\u001e\u000b\\t\ufffd\u0340h\ufffd$7G\ufffd\ufffdd\ufffd\ufffdqq\ufffd\ufffd\u0011\ufffd\ufffd\ufffda(\u0015\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "09b2fbcd2385bd2df902f056c4f0c7f9",
"tls_ja4": "e8816d96498378b78a33c72415cadd50",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd~\ufffd\ufffd@h\ufffd4>\ufffd\ufffd\ufffdT\ufffdL\ufffdS\ufffdM0\ufffd\ufffdRD\ufffdhJ\ufffd\ufffd \ufffd\ufffd\\t\ufffd\u0340h\ufffd$7G\ufffd\ufffdd\ufffd\ufffdqq\ufffd\ufffd\ufffd\ufffd\ufffda(\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 6913dc1a0af2baba
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� �����f�gZ�2���K��r�f0��' �)� ���!��tk�E'˜ �� �&�qd�W0 �*" �,�+̩�0�/̨ � � http/1.1 + #
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����f�gZ�2���K��r�f0��'
�)� ���!��tk�E'˜ �� �&�qd�W0 �*" �,�+̩�0�/̨ � � http/1.1 + #
Requête brute (extrait)
� �����f�gZ�2���K��r�f0��' �)� ���!��tk�E'˜ �� �&�qd�W0 �*" �,�+̩�0�/̨ � � http/1.1 + # 3 & $ ܥjՃW�UwK J���@cEs����� ����}7 -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.894268633743077,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a79345f695646d1c3d0aef063161efb8",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "6913dc1a0af2baba5eebdeb341c1c96e",
"ja4": "b1b89c94918ee1f07845688b9a928d98",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "6913dc1a0af2baba5eebdeb341c1c96e",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-43-35-23-51-5-13-45-10-11,29-23-24,0",
"tls_ja4_hash": "b1b89c94918ee1f07845688b9a928d98",
"tls_ja4": "t13d0110_92a4c12e67c3_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u001b\ufffd\ufffdf\ufffdgZ\ufffd2\ufffd\ufffd\ufffdK\ufffd\ufffdr\ufffd\uf6a5f0\ufffd\ufffd'\r\u001e\ufffd)\ufffd \ufffd\ufffd\ufffd!\ufffd\ufffdtk\u001b\ufffdE'\u02dc\u001f\ufffd\ufffd\u001d\ufffd&\ufffdqd\ufffdW0\u0001\u001c\ufffd\u001a*\"\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u001b\ufffd\ufffdf\ufffdgZ\ufffd2\ufffd\ufffd\ufffdK\ufffd\ufffdr\ufffd\uf6a5f0\ufffd\ufffd'\r\u001e\ufffd)\ufffd \ufffd\ufffd\ufffd!\ufffd\ufffdtk\u001b\ufffdE'\u02dc\u001f\ufffd\ufffd\u001d\ufffd&\ufffdqd\ufffdW0\u0001\u001c\ufffd\u001a*\"\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u0000\u0017\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0725j\u0543W\ufffd\u0006UwK\u0000J\ufffd\ufffd\ufffd@cEs\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd}7\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u001b\ufffd\ufffdf\ufffdgZ\ufffd2\ufffd\ufffd\ufffdK\ufffd\ufffdr\ufffd\uf6a5f0\ufffd\ufffd'\r\u001e\ufffd)\ufffd \ufffd\ufffd\ufffd!\ufffd\ufffdtk\u001b\ufffdE'\u02dc\u001f\ufffd\ufffd\u001d\ufffd&\ufffdqd\ufffdW0\u0001\u001c\ufffd\u001a*\"\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "94525e87fd82d175f3974e280d796169d609df22",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u001b\ufffd\ufffdf\ufffdgZ\ufffd2\ufffd\ufffd\ufffdK\ufffd\ufffdr\ufffd\uf6a5f0\ufffd\ufffd'\r\u001e\ufffd)\ufffd \ufffd\ufffd\ufffd!\ufffd\ufffdtk\u001b\ufffdE'\u02dc\u001f\ufffd\ufffd\u001d\ufffd&\ufffdqd\ufffdW0\u0001\u001c\ufffd\u001a*\"\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#",
"tls_ja3": "6913dc1a0af2baba5eebdeb341c1c96e",
"tls_ja4": "b1b89c94918ee1f07845688b9a928d98",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\ufffdgZ\ufffd2\ufffd\ufffd\ufffdK\ufffd\ufffdr\ufffd\uf6a5f0\ufffd\ufffd'\r\ufffd)\ufffd \ufffd\ufffd\ufffd!\ufffd\ufffdtk\ufffdE'\u02dc\ufffd\ufffd\ufffd&\ufffdqd\ufffdW0\ufffd*\"\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1+#",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u001b\ufffd\ufffdf\ufffdgZ\ufffd2\ufffd\ufffd\ufffdK\ufffd\ufffdr\ufffd\uf6a5f0\ufffd\ufffd'\r\u001e\ufffd)\ufffd \ufffd\ufffd\ufffd!\ufffd\ufffdtk\u001b\ufffdE'\u02dc\u001f\ufffd\ufffd\u001d\ufffd&\ufffdqd\ufffdW0\u0001\u001c\ufffd\u001a*\"\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#",
"tls_ja3": "6913dc1a0af2baba5eebdeb341c1c96e",
"tls_ja4": "b1b89c94918ee1f07845688b9a928d98",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf\ufffdgZ\ufffd2\ufffd\ufffd\ufffdK\ufffd\ufffdr\ufffd\uf6a5f0\ufffd\ufffd'\r\ufffd)\ufffd \ufffd\ufffd\ufffd!\ufffd\ufffdtk\ufffdE'\u02dc\ufffd\ufffd\ufffd&\ufffdqd\ufffdW0\ufffd*\"\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\thttp\/1.1+#",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · SPLUNK
|
splunk
|
splunk
splunk · via SPLUNK:8089 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 53aa51742d0bfd26
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
� ��x IQHI8�H� S�Tr��2ٌ�;6#��} ��t�?�LYu��Fi���@�� �\�/�=? �,�+̩�0�/̨ � �
Pourquoi cette classification : Type « splunk » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��x IQHI8�H� S�Tr��2ٌ�;6#��} ��t�?�LYu��Fi���@�� �\�/�=? �,�+̩�0�/̨ � �
Requête brute (extrait)
� ��x IQHI8�H� S�Tr��2ٌ�;6#��} ��t�?�LYu��Fi���@�� �\�/�=? �,�+̩�0�/̨ � � + # 3 & $ �A�b�)�&�܁���t� ).p���̅Qs@ http/1.1 -
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 241,
"payload_entropy": 5.8685714389656916,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 24,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "3d5dce98d3b37bf4e114af6e25b651b07c319b07",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"service_name": "splunk",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1743c94c6f31b283bb0ace38583c47e8",
"path_pattern_hash": "101e21bef69a3df68f36ca31deb6616f",
"ja3": "53aa51742d0bfd26ea466a6b20878437",
"ja4": "03e9d5e06c0354c8d0e80bdb71ad990f",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner"
},
"tls_ja3_hash": "53aa51742d0bfd26ea466a6b20878437",
"tls_ja3": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-5-43-35-51-11-10-16-23-45,29-23-24,0",
"tls_ja4_hash": "03e9d5e06c0354c8d0e80bdb71ad990f",
"tls_ja4": "t13d0110_36791fd92141_28135b4947ef",
"tls_version": "0x0303",
"tls_cipher_count": 10,
"ja3_client_category": "nmap_scanner",
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx IQH\u001aI8\ufffdH\ufffd\u001dS\ufffdTr\ufffd\u0002\ufffd2\u064c\ufffd;6#\ufffd\u0014\ufffd\u0018} \ufffd\ufffdt\ufffd\u0016?\ufffdLYu\ufffd\ufffd\u0018Fi\ufffd\ufffd\ufffd@\ufffd\ufffd\u001f\ufffd\u001a\\\u0012\ufffd\/\ufffd=?\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx IQH\u001aI8\ufffdH\ufffd\u001dS\ufffdTr\ufffd\u0002\ufffd2\u064c\ufffd;6#\ufffd\u0014\ufffd\u0018} \ufffd\ufffdt\ufffd\u0016?\ufffdLYu\ufffd\ufffd\u0018Fi\ufffd\ufffd\ufffd@\ufffd\ufffd\u001f\ufffd\u001a\\\u0012\ufffd\/\ufffd=?\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005\b\u0006\b\u0007\b\b\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000#\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdA\ufffdb\u0011\ufffd)\ufffd&\u000f\ufffd\u0701\ufffd\ufffd\u0006\ufffdt\ufffd\n).p\ufffd\u0016\ufffd\ufffd\u0305Qs@\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000-\u0000\u0002\u0001\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx IQH\u001aI8\ufffdH\ufffd\u001dS\ufffdTr\ufffd\u0002\ufffd2\u064c\ufffd;6#\ufffd\u0014\ufffd\u0018} \ufffd\ufffdt\ufffd\u0016?\ufffdLYu\ufffd\ufffd\u0018Fi\ufffd\ufffd\ufffd@\ufffd\ufffd\u001f\ufffd\u001a\\\u0012\ufffd\/\ufffd=?\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "492f5e53ccc56971733b42e1a32526333aaac0ec",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx IQH\u001aI8\ufffdH\ufffd\u001dS\ufffdTr\ufffd\u0002\ufffd2\u064c\ufffd;6#\ufffd\u0014\ufffd\u0018} \ufffd\ufffdt\ufffd\u0016?\ufffdLYu\ufffd\ufffd\u0018Fi\ufffd\ufffd\ufffd@\ufffd\ufffd\u001f\ufffd\u001a\\\u0012\ufffd\/\ufffd=?\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "53aa51742d0bfd26ea466a6b20878437",
"tls_ja4": "03e9d5e06c0354c8d0e80bdb71ad990f",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "\ufffd\ufffd\ufffdx IQHI8\ufffdH\ufffdS\ufffdTr\ufffd\ufffd2\u064c\ufffd;6#\ufffd\ufffd} \ufffd\ufffdt\ufffd?\ufffdLYu\ufffd\ufffdFi\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\\\ufffd\/\ufffd=?\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab splunk \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 24,
"behavior": 0,
"geo": 40,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdx IQH\u001aI8\ufffdH\ufffd\u001dS\ufffdTr\ufffd\u0002\ufffd2\u064c\ufffd;6#\ufffd\u0014\ufffd\u0018} \ufffd\ufffdt\ufffd\u0016?\ufffdLYu\ufffd\ufffd\u0018Fi\ufffd\ufffd\ufffd@\ufffd\ufffd\u001f\ufffd\u001a\\\u0012\ufffd\/\ufffd=?\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\r\u0000\u001c\u0000\u001a\u0002\u0001\u0002\u0003\u0004\u0001\u0004\u0003\u0005\u0001\u0005\u0003\u0006\u0001\u0006\u0003\b\u0004\b\u0005",
"tls_ja3": "53aa51742d0bfd26ea466a6b20878437",
"tls_ja4": "03e9d5e06c0354c8d0e80bdb71ad990f",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "splunk \u00b7 via SPLUNK:8089 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdx IQHI8\ufffdH\ufffdS\ufffdTr\ufffd\ufffd2\u064c\ufffd;6#\ufffd\ufffd} \ufffd\ufffdt\ufffd?\ufffdLYu\ufffd\ufffdFi\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\\\ufffd\/\ufffd=?\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /src/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /src/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/src/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/src/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /src/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "46e050e820087702ef14a381ebad48881db62e31",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 4.967898480203759,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1e663d511758a3a6ff9fb7fa391672155179e80c",
"event_fingerprint": "885e7e710f37eeeb0ab8d8ed9523b34ba71badc8",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "ed148f95630f294cfcf386ee390d142c",
"path_pattern_hash": "83762003e224a5603ed7ad8ff32c59fc"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/src\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/src\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"request_sample": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9cbb660ecbbae743dab367fa165149855aa23162",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.git\/config",
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/.git\/config",
"request_line": "GET \/src\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/.git\/config",
"evidence_snippet": "GET \/src\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /app/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /app/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/app/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/app/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /app/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "c0d576333b61f38bb5785040d2824435407a4c84",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 4.994907181205362,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1e663d511758a3a6ff9fb7fa391672155179e80c",
"event_fingerprint": "259ae33654d291ac76dfd4e1345aca03485cad00",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "0be2d31faa66f78a4684b4c40c0a5ca9",
"path_pattern_hash": "87d63e686c8d80bd28afc993649c7598"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/app\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/app\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"request_sample": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9532787bd8884ad7d1261f6b041d958e22be3f36",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.git\/config",
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/.git\/config",
"request_line": "GET \/app\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.git\/config",
"evidence_snippet": "GET \/app\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /backend/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/backend/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/backend/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /backend/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "2482ac6c987d570b89dfba6cfee3dc3ac194789d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.023990007370059,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1e663d511758a3a6ff9fb7fa391672155179e80c",
"event_fingerprint": "0d3456acd91c0446640035ded26474de2a467170",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "e19bbe3a87534928dff5c97b2d733b01",
"path_pattern_hash": "2de751ea5a34e7a22b69004dc29faa62"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/backend\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/backend\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"request_sample": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d2744dfd6c07e1a06d4a5a999f089ae510585d2e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.git\/config",
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/.git\/config",
"request_line": "GET \/backend\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/.git\/config",
"evidence_snippet": "GET \/backend\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /htdocs/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /htdocs/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/htdocs/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/htdocs/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /htdocs/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /htdocs/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "91751256d60394a8b0340bb86ad1a8313b8dadfa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 105,
"payload_entropy": 4.9921849620214305,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1e663d511758a3a6ff9fb7fa391672155179e80c",
"event_fingerprint": "8ff3347a19aea85dc522dbafda3f62f34d26617a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "f00cafc9d7a7ef4b4bdeaa5f05520609",
"path_pattern_hash": "9d5b4b02a118c63f9864fb4303c2c2fa"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/htdocs\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/htdocs\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"request_sample": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d53ba897e8ad677321bf846bb5b9218044dc23bd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/htdocs\/.git\/config",
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/htdocs\/.git\/config",
"request_line": "GET \/htdocs\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.git\/config",
"evidence_snippet": "GET \/htdocs\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /www/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /www/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/www/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/www/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /www/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "7b5c6d1b9506a8d5fe958dbcf1ffdcdd61f34f9e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 4.994907181205362,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1e663d511758a3a6ff9fb7fa391672155179e80c",
"event_fingerprint": "ac8166549a47258bd311398f1a7600aadb73c998",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "3265d01e599b9c381f714a6ac049eef0",
"path_pattern_hash": "2067f182832f5bbc5f3205656471af53"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "16e9b042877e805f41cc7ec73e690d084688967e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/www\/.git\/config",
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/www\/.git\/config",
"request_line": "GET \/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/www\/.git\/config",
"evidence_snippet": "GET \/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /var/www/.git/config
|
Élevée
|
Élevé · 69
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /var/www/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950312:lfi-13
950468:nosqli-3
950513:leak-0
http_backup_file_scan
Cible HTTP
GET
/var/www/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/var/www/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-13 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /var/www/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
lfi-13
nosqli-3
leak-0
Payload (extrait)
GET /var/www/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "5bc04837a815dc3b9c63afd166a20d43881e48d8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.007224144412738,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 96,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.1,
"risk_breakdown": {
"waf": 96,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "2352894a06cbf1dcf3a6f8ab01bc94efae725e44",
"event_fingerprint": "f9a13958396249f856e8ffdd2ce5fb9af9ea47ae",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 96,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "5d15ddb28658b9aa67461760233d2f02",
"path_pattern_hash": "3bba9c9f0da0327b3f567a33822f22e3"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/var\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950312:lfi-13",
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"lfi-13",
"nosqli-3",
"leak-0"
],
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/var\/www\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950312:lfi-13",
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"lfi-13",
"nosqli-3",
"leak-0"
],
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"request_sample": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a3459c13b5e201c13be7c47b888cf7b6b656abc6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/.git\/config",
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/var\/www\/.git\/config",
"request_line": "GET \/var\/www\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/www\/.git\/config",
"evidence_snippet": "GET \/var\/www\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950312:lfi-13",
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0198
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.git/config
Ligne de requête
GET /.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "e2f253eab0d0cf5422d24d22ae2a4954398768df",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 4.990151498520767,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.1,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "60d1fe3bbca9fa4de56d9c6577ea9aab736bee78",
"event_fingerprint": "265b8c2885e638923534e8ff628364a160d5c368",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0198",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0198",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0198"
],
"matched_pattern_names": [
"Probe \/.git\/config"
],
"pattern_ids": [
"pat-0198"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "98481571deda0c09a1d41ba952f54973",
"path_pattern_hash": "3ec26e4f0817b37785cd5e68fed88892"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/.git\/config HTTP\/1.1",
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/.git\/config HTTP\/1.1",
"request_sample": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "557d25e01758b7f7955c1286638cd62dd4af676e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.git\/config",
"request_line": "GET \/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0198",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0198",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.git\/config",
"request_line": "GET \/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.git\/config",
"evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_probe_git",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /api/.git/config
|
Élevée
|
Moyen · 64
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
18
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
950600:k8s-api
http_backup_file_scan
Cible HTTP
GET
/api/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/api/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /api/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
k8s-api
Payload (extrait)
GET /api/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "4d60538c38eae0fe13cbc99a2ea3645cbb337669",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 4.994907181205362,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 80,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.4,
"risk_breakdown": {
"waf": 80,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 64,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1b11c29c5ea64e936fff5a4cbe808590ccc66845",
"event_fingerprint": "9f575391bb4515c641172c33914a4e01c4d11118",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 80,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "8c72535f3c462ad248d1bd640a8a19de",
"path_pattern_hash": "3ed56f63a5d3aef03e8853abb49b3eea"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/api\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0",
"950600:k8s-api"
],
"waf_rule_names": [
"nosqli-3",
"leak-0",
"k8s-api"
],
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/api\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0",
"950600:k8s-api"
],
"waf_rule_names": [
"nosqli-3",
"leak-0",
"k8s-api"
],
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "42fe111def1bbb5bb7a2e6f67f685b8fa2b6323b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.git\/config",
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 80,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/.git\/config",
"request_line": "GET \/api\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config",
"evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 80 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"950600:k8s-api",
"http_backup_file_scan",
"http_git_exposure",
"http_probe_api",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /wordpress/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /wordpress/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/wordpress/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/wordpress/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /wordpress/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /wordpress/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "466d1ef9599315e8ea185d729b1bb7f4ef3f3e3e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 4.984992165329095,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1e663d511758a3a6ff9fb7fa391672155179e80c",
"event_fingerprint": "a1346c0e988dbae947fc991708d7ddc202235fd8",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "6c2efb418bdd8e9b8928e5d9171def2a",
"path_pattern_hash": "065fde2a84971d9e936ccb4d03006f9c"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/wordpress\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/wordpress\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"request_sample": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "85f3e7aa39c9d897c4a326b35bdc172830dc5a4d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wordpress\/.git\/config",
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wordpress\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wordpress\/.git\/config",
"request_line": "GET \/wordpress\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wordpress\/.git\/config",
"evidence_snippet": "GET \/wordpress\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /public/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /public/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/public/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/public/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /public/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /public/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "8257582ae447b9a2124e0414764cac0aac8808de",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 105,
"payload_entropy": 5.05494772836222,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1e663d511758a3a6ff9fb7fa391672155179e80c",
"event_fingerprint": "ba8566e0e7466a305d0c3497dcc872ace7f9d38a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "20539da87a76f62eac61e03ed8237e7f",
"path_pattern_hash": "78b85c05b86f9869fecb7907511b414c"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/public\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/public\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"request_sample": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aecc1f9659605350e9f6a62ba83d1ca2cf942af9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/.git\/config",
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/.git\/config",
"request_line": "GET \/public\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.git\/config",
"evidence_snippet": "GET \/public\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /html/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /html/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/html/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/html/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /html/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /html/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "ed148acba970ce3061829b4dd97608d1a6997773",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 5.048476324536789,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1e663d511758a3a6ff9fb7fa391672155179e80c",
"event_fingerprint": "07de64ecc2b37b96a5e36af63991e19bbfc9ca93",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "5d8caefd88bdf3cb05ca419553d003df",
"path_pattern_hash": "985e825857a4aae20b7bcc62b05870c4"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/html\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/html\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"request_sample": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "beeb1ca1ebb9689a88ed76bb56da8dcc8224c6bc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/html\/.git\/config",
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/html\/.git\/config",
"request_line": "GET \/html\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/html\/.git\/config",
"evidence_snippet": "GET \/html\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8089 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:8089 · (tentative d'exploit) · → /site/.git/config
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /site/.git/config UA crusader-worker/1.0
Émulateur
HTTP
WAF
14
Recommandation
Investiguer
Tags
950468:nosqli-3
950513:leak-0
http_backup_file_scan
http_git_exposure
Cible HTTP
GET
/site/.git/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8089
Chemin / cible
/site/.git/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « nosqli-3 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /site/.git/config HTTP/1.1
User-Agent
crusader-worker/1.0
Règles WAF
nosqli-3
leak-0
Payload (extrait)
GET /site/.git/config HTTP/1.1
accept: */*
user-agent: crusader-worker/1.0
host: 62.3.50.33:8089
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "git\/config",
"http_ua_hash": "655df0f3f911a15b4f4bf8e4813996a4ecac7879",
"http_host_hash": "6e7855f9d1ec5b350040e6a7fa2c7046d35c68a6",
"http_target_hash": "99d75e39037b11054e155a03133c80282ea1c965",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 4.971775989295138,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "BE",
"dst_port": 8089,
"risk_waf": 64,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "1e663d511758a3a6ff9fb7fa391672155179e80c",
"event_fingerprint": "d1825fbd5bff945219ce076678ac99378f6abdf9",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "16953de589ee631f0fcf6d96eceb8f57",
"payload_hash": "91331a49fe380c8968291def6ab2623d",
"path_pattern_hash": "6901c63c2daa99b93d9d7c027371b852"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"method": "GET",
"path": "\/site\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"evidence": {
"method": "GET",
"path": "\/site\/.git\/config",
"user_agent": "crusader-worker\/1.0",
"waf_tags": [
"950468:nosqli-3",
"950513:leak-0"
],
"waf_rule_names": [
"nosqli-3",
"leak-0"
],
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"request_sample": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089\r\n\r\n",
"payload_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb24ac687bb94b8ebe8ee06901ac0fce279e1045",
"protocol_details": {
"http_method": "GET",
"http_path": "\/site\/.git\/config",
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/.git\/config",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 64,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/site\/.git\/config",
"request_line": "GET \/site\/.git\/config HTTP\/1.1",
"http_user_agent": "crusader-worker\/1.0",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8089 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/site\/.git\/config",
"evidence_snippet": "GET \/site\/.git\/config HTTP\/1.1\r\naccept: *\/*\r\nuser-agent: crusader-worker\/1.0\r\nhost: 62.3.50.33:8089",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950513:leak-0",
"http_backup_file_scan",
"http_git_exposure",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|