30/07/2026 11:37:54 UTC
TCP
8000 · SAP ICM
Sonde SAP ICM HTTP
Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
� google.com
Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� google.com
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 20,
"payload_entropy": 3.1659573209491745,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 208137,
"country": "TW",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "cff6a4747fcb525bc1a51c1020210f5d3a8f4ca3",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 45
},
"service_name": "sap-icm",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5f2ac59ec29aee495f153c899f14990",
"path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 45
},
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "93d8c2d5961e066fc2d10ace4a6f614b394fc81d",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "\ufffdgoogle.com",
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdgoogle.com",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload",
"socks4_greeting"
]
}
30/07/2026 11:37:54 UTC
TCP
8000 · SAP ICM
Sonde SAP ICM HTTP
Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Pourquoi cette classification : Type « sap_web_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 208137,
"country": "TW",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.7,
"risk_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "fde955bf43c7c4b00cd0c562925798aa58e85e0f",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 45
},
"service_name": "sap-icm",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab0b44ae647a0fe1219078bfc404a002346f7545",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "Sonde SAP ICM \/ WebDynpro \u00b7 via SAP ICM:8000 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload",
"socks5_greeting"
]
}
30/07/2026 11:37:54 UTC
TCP
8000 · SAP ICM
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
Élevée
Moyen · 46
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT google.com HTTP/1.1 Host: google.com Proxy-Connection: keep-alive Connection: keep-alive
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT google.com HTTP/1.1
Host: google.com
Proxy-Connection: keep-alive
Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 103,
"payload_entropy": 4.663665916542615,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 208137,
"country": "TW",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP"
],
"pattern_ids": [
"pat-0418",
"pat-0559"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6bd29a49bb3e2ce37d8ea967b667970b",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"evidence": {
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b1fbb9ce7cc13c85e8756b642da6a0e54111f835",
"protocol_details": {
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
28/07/2026 10:46:59 UTC
TCP
1081
—
proxy probe
proxy probe · port 1081 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1081
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": null,
"app_proto": null,
"asn": 208137,
"country": "TW",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "23a4b5e2adf47a9305e898f7897eae0ee58fc794",
"event_fingerprint": "35f50dad8283ad1fc1432bed469c94a0d1d87aa1",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1081,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "28d8dccb1b4047fb755d710c953a43b5835c528f",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1081
},
"attack_vector": "proxy probe \u00b7 port 1081 \u00b7 (sonde \/ probe)",
"target_port_label": "1081",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1081
},
"attack_vector": "proxy probe \u00b7 port 1081 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1081",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
28/07/2026 10:46:58 UTC
TCP
1081 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:1081 · (sonde / probe) · → google.com
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT google.com
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
google.com
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
1081
Chemin / cible
google.com
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT google.com HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT google.com HTTP/1.1
Host: google.com
Proxy-Connection: keep-alive
Connection: keep-alive
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "com",
"http_ua_hash": null,
"http_host_hash": "baea954b95731c68ae6e45bd1e252eb4560cdc45",
"http_target_hash": "baea954b95731c68ae6e45bd1e252eb4560cdc45",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 4.663665916542615,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8ae13c6df003342b46d876c4543176bc11bd9986",
"event_fingerprint": "9efb17967ad2360e3417f23b8247429325009a32",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6bd29a49bb3e2ce37d8ea967b667970b",
"path_pattern_hash": "d4c9d9027326271a89ce51fcaf328ed6"
},
"service_name": "http",
"target_context": {
"dst_port": 1081,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"method": "CONNECT",
"path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"evidence": {
"method": "CONNECT",
"path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96a34c8febcc8383a2066203565c879ce2dda351",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"port": 1081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1081 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com",
"target_port_label": "1081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"port": 1081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1081 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com",
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"target_port_label": "1081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
28/07/2026 10:46:58 UTC
TCP
1081
—
proxy probe
proxy probe · port 1081 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1081
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� google.com
Meta JSON brut
{
"bytes_in": 20,
"payload_entropy": 3.1659573209491745,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": null,
"app_proto": null,
"asn": 208137,
"country": "TW",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "a3a5d29121b992f388caf9b745a687ab40c9cac9",
"event_fingerprint": "35f50dad8283ad1fc1432bed469c94a0d1d87aa1",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5f2ac59ec29aee495f153c899f14990",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1081,
"risk_score": 35
},
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ce017e14a77238cbcb7095b59d7ab71da7ac614",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"port": 1081
},
"evidence_snippet": "\ufffdgoogle.com",
"attack_vector": "proxy probe \u00b7 port 1081 \u00b7 (sonde \/ probe)",
"target_port_label": "1081",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"port": 1081
},
"attack_vector": "proxy probe \u00b7 port 1081 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdgoogle.com",
"target_port_label": "1081",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
25/07/2026 22:53:48 UTC
TCP
1081 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:1081 · (sonde / probe) · → google.com
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT google.com
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
google.com
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
1081
Chemin / cible
google.com
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT google.com HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT google.com HTTP/1.1
Host: google.com
Proxy-Connection: keep-alive
Connection: keep-alive
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "com",
"http_ua_hash": null,
"http_host_hash": "baea954b95731c68ae6e45bd1e252eb4560cdc45",
"http_target_hash": "baea954b95731c68ae6e45bd1e252eb4560cdc45",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 4.663665916542615,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "8ae13c6df003342b46d876c4543176bc11bd9986",
"event_fingerprint": "9efb17967ad2360e3417f23b8247429325009a32",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6bd29a49bb3e2ce37d8ea967b667970b",
"path_pattern_hash": "d4c9d9027326271a89ce51fcaf328ed6"
},
"service_name": "http",
"target_context": {
"dst_port": 1081,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"method": "CONNECT",
"path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"evidence": {
"method": "CONNECT",
"path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96a34c8febcc8383a2066203565c879ce2dda351",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"port": 1081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1081 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com",
"target_port_label": "1081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"port": 1081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:1081 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com",
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"target_port_label": "1081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
]
}
25/07/2026 22:53:48 UTC
TCP
1081
—
proxy probe
proxy probe · port 1081 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1081
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� google.com
Meta JSON brut
{
"bytes_in": 20,
"payload_entropy": 3.1659573209491745,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": null,
"app_proto": null,
"asn": 208137,
"country": "TW",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "a3a5d29121b992f388caf9b745a687ab40c9cac9",
"event_fingerprint": "35f50dad8283ad1fc1432bed469c94a0d1d87aa1",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5f2ac59ec29aee495f153c899f14990",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1081,
"risk_score": 35
},
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ce017e14a77238cbcb7095b59d7ab71da7ac614",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"port": 1081
},
"evidence_snippet": "\ufffdgoogle.com",
"attack_vector": "proxy probe \u00b7 port 1081 \u00b7 (sonde \/ probe)",
"target_port_label": "1081",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"port": 1081
},
"attack_vector": "proxy probe \u00b7 port 1081 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdgoogle.com",
"target_port_label": "1081",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
]
}
25/07/2026 22:53:48 UTC
TCP
1081
—
proxy probe
proxy probe · port 1081 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks5_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1081
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": null,
"app_proto": null,
"asn": 208137,
"country": "TW",
"dst_port": 1081,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "23a4b5e2adf47a9305e898f7897eae0ee58fc794",
"event_fingerprint": "35f50dad8283ad1fc1432bed469c94a0d1d87aa1",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 1081,
"risk_score": 35
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "28d8dccb1b4047fb755d710c953a43b5835c528f",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1081
},
"attack_vector": "proxy probe \u00b7 port 1081 \u00b7 (sonde \/ probe)",
"target_port_label": "1081",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 1081,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1081
},
"attack_vector": "proxy probe \u00b7 port 1081 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1081",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "1081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:1081"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks5_greeting"
]
}
25/07/2026 14:36:12 UTC
TCP
1080 · SOCKS5
Flood / DDoS
http flood · via SOCKS5:1080 · (tentative d'exploit)
Élevée
Moyen · 46
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
CONNECT google.com HTTP/1.1 Host: google.com Proxy-Connection: keep-alive Connection: keep-alive
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT google.com HTTP/1.1
Host: google.com
Proxy-Connection: keep-alive
Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 103,
"payload_entropy": 4.663665916542615,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "socks5",
"app_proto": "socks5",
"asn": 208137,
"country": "TW",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 46,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP"
],
"pattern_ids": [
"pat-0418",
"pat-0559"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6bd29a49bb3e2ce37d8ea967b667970b",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 46
},
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"evidence": {
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "652054d3c602e396100e6e52b68a855a86135807",
"protocol_details": {
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SOCKS5",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated"
]
}
25/07/2026 14:36:12 UTC
TCP
1080 · SOCKS5
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks4_greeting
socks5_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1080
Chemin / cible
—
Service
SOCKS5
Payload
� google.com
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� google.com
Meta JSON brut
{
"protocol_emulated": true,
"bytes_in": 20,
"payload_entropy": 3.1659573209491745,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "socks5",
"app_proto": "socks5",
"asn": 208137,
"country": "TW",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"service_name": "socks5",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d5f2ac59ec29aee495f153c899f14990",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b28c6834791c395daed8cb60a392dab6ec5fc217",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"evidence_snippet": "\ufffdgoogle.com",
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000google.com\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffdgoogle.com",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks4_greeting",
"socks5_emulated"
]
}
25/07/2026 14:36:12 UTC
TCP
1080 · SOCKS5
socks5 probe
socks5 probe · via SOCKS5:1080 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SOCKS5
WAF
—
Recommandation
Surveiller
Tags
net_socks5_probe
socks5_emulated
socks5_greeting
socks5_handshake
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
1080
Chemin / cible
—
Pourquoi cette classification : Type « socks5_probe » (signaux protocolaires) · confiance 67%
Confiance classification
67%
Risque capteur
Moyen
· 45
Confiance : Confiance 67 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0567
Upstream
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Minecraft varint handshake
SOCKS5 greeting
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "0500",
"emulator_response_len": 2,
"bytes_in": 3,
"payload_entropy": 1.584962500721156,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "socks5",
"app_proto": "socks5",
"asn": 208137,
"country": "TW",
"dst_port": 1080,
"risk_waf": 8,
"risk_classification": 50,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "271d05a6cd2323b9ac63bce8f3ac33332ef07649",
"event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"confidence": 0.67,
"classification_confidence": 0.67,
"precision_score": 75,
"precision_signals": [
"pat-0567",
"INT-upstream"
],
"kb_rule_ids": [
"pat-0567",
"INT-upstream"
],
"matched_patterns": [
"pat-0554",
"pat-0567"
],
"matched_pattern_names": [
"Minecraft varint handshake",
"SOCKS5 greeting"
],
"pattern_ids": [
"pat-0554",
"pat-0567"
],
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "socks5",
"risk_confidence_factor": 67,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "da075e9d699084fc189cdd233081c49f",
"path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
},
"target_context": {
"dst_port": 1080,
"service": "socks5",
"service_name": "socks5",
"risk_score": 45
},
"payload_preview": "\u0005\u0001\u0000",
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"evidence": {
"request_sample": "\u0005\u0001\u0000",
"payload_snippet": "\u0005\u0001\u0000",
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"network_service_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d80e8fd6254a8b4da743f53b12e94ed91fca06d",
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 67%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 67,
"confidence_breakdown": {
"waf": 8,
"classification": 50,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 45
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "socks5",
"service_label_fr": "SOCKS5",
"dst_port": 1080,
"protocol_emulated": true,
"tags_summary": [
"pat-0567",
"INT-upstream"
],
"tags_summary_labels_fr": [
"pat-0567",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-socks5",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0005\u0001\u0000",
"port": 1080,
"service": "socks5",
"service_label_fr": "SOCKS5"
},
"attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "1080 \u00b7 SOCKS5",
"emulator_service": "socks5",
"confidence_reason": "Confiance 67 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 67 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "socks5",
"service_banner": "honeypot-socks5",
"service_os": "linux",
"dst_port": "1080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_socks5_probe",
"socks5_emulated",
"socks5_greeting",
"socks5_handshake"
]
}
25/07/2026 10:49:51 UTC
TCP
8000 · SAP ICM
Flood / DDoS
http flood · via SAP ICM:8000 · (tentative d'exploit)
Élevée
Moyen · 46
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-ICM
WAF
—
Recommandation
Surveiller
Tags
net_sap_web_probe
sap_icm_emulated
sap_icm_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8000
Chemin / cible
—
Service
SAP ICM
Payload
CONNECT google.com HTTP/1.1 Host: google.com Proxy-Connection: keep-alive Connection: keep-alive
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT google.com HTTP/1.1
Host: google.com
Proxy-Connection: keep-alive
Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
"emulator_response_len": 141,
"bytes_in": 103,
"payload_entropy": 4.663665916542615,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "sap-icm",
"app_proto": "sap-icm",
"asn": 208137,
"country": "TW",
"dst_port": 8000,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
"event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP"
],
"pattern_ids": [
"pat-0418",
"pat-0559"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "sap-icm",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6bd29a49bb3e2ce37d8ea967b667970b",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 8000,
"service": "sap-icm",
"service_name": "sap-icm",
"risk_score": 46
},
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"evidence": {
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b1fbb9ce7cc13c85e8756b642da6a0e54111f835",
"protocol_details": {
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "sap-icm",
"service_label_fr": "SAP ICM",
"dst_port": 8000,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-icm",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"port": 8000,
"service": "sap-icm",
"service_label_fr": "SAP ICM"
},
"attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"target_port_label": "8000 \u00b7 SAP ICM",
"emulator_service": "sap-icm",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_icm",
"service_banner": "honeypot-sap-icm",
"service_os": "linux",
"dst_port": "8000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_web_probe",
"sap_icm_emulated",
"sap_icm_payload"
]
}
25/07/2026 10:49:51 UTC
TCP
8080 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → google.com
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT google.com
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
google.com
TLS SNI
—
Capteur
paris-1
Méthode
CONNECT
Port
8080
Chemin / cible
google.com
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
85%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT google.com HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT google.com HTTP/1.1
Host: google.com
Proxy-Connection: keep-alive
Connection: keep-alive
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "com",
"http_ua_hash": null,
"http_host_hash": "baea954b95731c68ae6e45bd1e252eb4560cdc45",
"http_target_hash": "baea954b95731c68ae6e45bd1e252eb4560cdc45",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 103,
"payload_entropy": 4.663665916542615,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "41e08987a36e1b363366eacd6f113645eb57f990",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6bd29a49bb3e2ce37d8ea967b667970b",
"path_pattern_hash": "d4c9d9027326271a89ce51fcaf328ed6"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"method": "CONNECT",
"path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"evidence": {
"method": "CONNECT",
"path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"request_sample": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\n\r\n",
"payload_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.85,
"classification_confidence": 0.85,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef670a0dd6e7b51ce2e6b7f61d6954a4d5ffffec",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 85,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "google.com",
"request_line": "CONNECT google.com HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com",
"evidence_snippet": "CONNECT google.com HTTP\/1.1\r\nHost: google.com\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-icm"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
]
}
16/07/2026 22:04:21 UTC
TCP
8080 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /.env
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env UA Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0
A
Requête brute (extrait)
GET /.env HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Accept: */* Accept-Encoding: identity
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "880d0c120dbf4497314046742f2cb6dbd4be704d",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "9ee0d3f55b39072ba6bec6203d26e470be80afdc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 169,
"payload_entropy": 5.2553471169509525,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 8080,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "51b65b0a15df2786ab9461e49aa4822ae6878c8d",
"event_fingerprint": "8a2fe31cf18283ee1184898bdb31081d3839d5a9",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a59685e43b0ef4fb9f3e6765d2231094",
"payload_hash": "d3bf61ab5540674bf044334a323f3d77",
"path_pattern_hash": "aef81e7735de8f42b73e111497498c8b"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nA",
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nA",
"evidence": {
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nA",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eaedbb1d2e4b79a81c1dd76e6ac7c9589e06cb61",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nA",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nA",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_env",
"http_sensitive_path",
"net_web_probe"
]
}
16/07/2026 22:04:17 UTC
TCP
8080 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP
WAF
—
Recommandation
Surveiller
Tags
http_alt_8080
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8080
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "986800c5ad65e75d541a277e48953dacf3f318da",
"event_fingerprint": "5afc6680f618e490dc22cb875ac6d45b5c7d65ea",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "945d6c54aac35f31bab6fba8d81332256826a36c",
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_8080",
"http_alt_port",
"net_web_probe"
]
}
16/07/2026 21:00:47 UTC
TCP
8080 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /.env
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
Requête brute (extrait)
GET /.env HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "34135990e474ac0a8e18c08839d6076fe8f1a196",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "9ee0d3f55b39072ba6bec6203d26e470be80afdc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.403618180111215,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 8080,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "51b65b0a15df2786ab9461e49aa4822ae6878c8d",
"event_fingerprint": "8a2fe31cf18283ee1184898bdb31081d3839d5a9",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93471414a280d667b4d37824ff5e6b20",
"payload_hash": "2e71abc0883ab2d1529d573fef878eaf",
"path_pattern_hash": "aef81e7735de8f42b73e111497498c8b"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd76b38085d644328fe7e489966022e6cb295616",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_env",
"http_sensitive_path",
"net_web_probe"
]
}
16/07/2026 20:59:21 UTC
TCP
8080 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP
WAF
—
Recommandation
Surveiller
Tags
http_alt_8080
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8080
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "986800c5ad65e75d541a277e48953dacf3f318da",
"event_fingerprint": "5afc6680f618e490dc22cb875ac6d45b5c7d65ea",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "945d6c54aac35f31bab6fba8d81332256826a36c",
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_8080",
"http_alt_port",
"net_web_probe"
]
}
16/07/2026 10:02:03 UTC
TCP
553
—
Sonde port
Sonde port · port 553 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
553
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": null,
"app_proto": null,
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "b8ecacd2876821def8febf7f4e992403fcf329cc",
"event_fingerprint": "8ab5ed9eb034d31c81dbda975e6fbdc29c468db6",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 553,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2799be40ab592808bb2b267de480a16e34cac662",
"protocol_details": {
"port": 553
},
"attack_vector": "Sonde port \u00b7 port 553 \u00b7 (sonde \/ probe)",
"target_port_label": "553",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 553
},
"attack_vector": "Sonde port \u00b7 port 553 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "553",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 10:01:55 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env1
Élevée
Moyen · 48
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env1 UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/.env1
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env1
Pourquoi cette classification : Type « config_file_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
pat-0191
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env1 HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.env1 HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ch
Requête brute (extrait)
GET /.env1 HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env1",
"http_ua_hash": "e0871089d7d4e6ad8303458c123cbcd9b591518a",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "2b5017c90633a8a34a82f4f13531d4457af46bf3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 220,
"payload_entropy": 5.45277587065589,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1622e9e4b5d5ba4de1dab3a913aca8a1c4e2975e",
"event_fingerprint": "742136cf86700eb62256a6c2fe9ac0a19ad1599a",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 143,
"precision_signals": [
"SIGMA-web-config-leak",
"pat-0191"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"pat-0191"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7bfbb51b235934598654bef5cad77b9b",
"payload_hash": "c3e08a522c1ee872106bb265373219e8",
"path_pattern_hash": "53c9cae85785c1d565c646e171f404a0"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/.env1 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"method": "GET",
"path": "\/.env1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.env1 HTTP\/1.1",
"request_sample": "GET \/.env1 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env1 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"evidence": {
"method": "GET",
"path": "\/.env1",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.env1 HTTP\/1.1",
"request_sample": "GET \/.env1 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env1 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5dc0a86602a0cd7b92c79b2ab98ace672fdf2ac1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env1",
"request_line": "GET \/.env1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env1 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env1",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"pat-0191"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"pat-0191"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env1",
"request_line": "GET \/.env1 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env1",
"evidence_snippet": "GET \/.env1 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Ch",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3"
]
}
16/07/2026 10:01:55 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env2
Élevée
Moyen · 48
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env2 UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/.env2
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env2
Pourquoi cette classification : Type « config_file_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
pat-0191
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env2 HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.env2 HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
Requête brute (extrait)
GET /.env2 HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env2",
"http_ua_hash": "34135990e474ac0a8e18c08839d6076fe8f1a196",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "2a4eb5d44efe431820e67c37846bcbe73f789e9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 230,
"payload_entropy": 5.41848879777931,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1622e9e4b5d5ba4de1dab3a913aca8a1c4e2975e",
"event_fingerprint": "baa2e8ed46d8493de8332648c2c61dbd9c8d26a1",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 143,
"precision_signals": [
"SIGMA-web-config-leak",
"pat-0191"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"pat-0191"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93471414a280d667b4d37824ff5e6b20",
"payload_hash": "05ee7b33000c9d4186c35abc9eff6011",
"path_pattern_hash": "187740d37d6dbd173282ecd5d2707953"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/.env2 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"method": "GET",
"path": "\/.env2",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.env2 HTTP\/1.1",
"request_sample": "GET \/.env2 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env2 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/.env2",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.env2 HTTP\/1.1",
"request_sample": "GET \/.env2 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env2 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "abd0a0685c3c29480d5e85bda58ac52fa65c5017",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env2",
"request_line": "GET \/.env2 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env2 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env2",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"pat-0191"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"pat-0191"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env2",
"request_line": "GET \/.env2 HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env2",
"evidence_snippet": "GET \/.env2 HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3"
]
}
16/07/2026 10:01:55 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.envNew
Élevée
Moyen · 48
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.envNew UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/.envNew
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.envNew
Pourquoi cette classification : Type « config_file_probe » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 48
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Signaux
SIGMA-web-config-leak
pat-0191
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.envNew HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.envNew HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Requête brute (extrait)
GET /.envNew HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "envnew",
"http_ua_hash": "e0871089d7d4e6ad8303458c123cbcd9b591518a",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "fea528381c1bfa95b0eda473719a833046ffb945",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 222,
"payload_entropy": 5.482987116537025,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 48,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1622e9e4b5d5ba4de1dab3a913aca8a1c4e2975e",
"event_fingerprint": "0b25112a04446610f9ec4f7c46a0151b21e52dfb",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 143,
"precision_signals": [
"SIGMA-web-config-leak",
"pat-0191"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"pat-0191"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7bfbb51b235934598654bef5cad77b9b",
"payload_hash": "81da0f032634f436c75572784b668f8d",
"path_pattern_hash": "1cecb136f55dc4662912daa81417cc20"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/.envNew HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) ",
"method": "GET",
"path": "\/.envNew",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.envNew HTTP\/1.1",
"request_sample": "GET \/.envNew HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.envNew HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"evidence": {
"method": "GET",
"path": "\/.envNew",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.envNew HTTP\/1.1",
"request_sample": "GET \/.envNew HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.envNew HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e623ab23af23539477bc55b174afff95b13bb706",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.envNew",
"request_line": "GET \/.envNew HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.envNew HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.envNew",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab config_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 48,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"pat-0191"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"pat-0191"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.envNew",
"request_line": "GET \/.envNew HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.envNew",
"evidence_snippet": "GET \/.envNew HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko)",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3"
]
}
16/07/2026 10:01:54 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.vercel
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.vercel UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.vercel
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.vercel
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.vercel HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.vercel HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gec
Requête brute (extrait)
GET /.env.vercel HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "vercel",
"http_ua_hash": "e0871089d7d4e6ad8303458c123cbcd9b591518a",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "a047545730527c6c4030834dd709cf1e441116c1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 226,
"payload_entropy": 5.446728355734581,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "5db4f1d3e567b3a87cbc039cf782cfc536fa4490",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7bfbb51b235934598654bef5cad77b9b",
"payload_hash": "ad04d56f9d6fbdeed790b6fcc82f3e5c",
"path_pattern_hash": "1dfbfbff41398329b39532d935d9de7f"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.vercel HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"method": "GET",
"path": "\/.env.vercel",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.vercel HTTP\/1.1",
"request_sample": "GET \/.env.vercel HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.vercel HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/.env.vercel",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.vercel HTTP\/1.1",
"request_sample": "GET \/.env.vercel HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.vercel HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "296e73aeb04c59fbb69b3be8691211b66ed55e66",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.vercel",
"request_line": "GET \/.env.vercel HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.vercel HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.vercel",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.vercel",
"request_line": "GET \/.env.vercel HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.vercel",
"evidence_snippet": "GET \/.env.vercel HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:50 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.staging
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.staging UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.staging
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.staging
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.staging HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.staging HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101
Requête brute (extrait)
GET /.env.staging HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "staging",
"http_ua_hash": "b34d153dbd2c170b15fb01dfadbb894c4e81abaf",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "b697ca05984d1bd61ac6a6cd96868703f3417431",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 206,
"payload_entropy": 5.262733828709151,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "97e3c6f0323430a011d190eddb351131a2a99ac8",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8c3dcbb12b0adbf722cf2d35dfa4069d",
"payload_hash": "be953a3d5f60b02311f9c830e2281ad8",
"path_pattern_hash": "273c68db2803cfd6e1d27200e5969039"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101",
"method": "GET",
"path": "\/.env.staging",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.staging HTTP\/1.1",
"request_sample": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101",
"evidence": {
"method": "GET",
"path": "\/.env.staging",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.staging HTTP\/1.1",
"request_sample": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1904c50e971063473e54f664d8672505f8219493",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.staging",
"request_line": "GET \/.env.staging HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.staging",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.staging",
"request_line": "GET \/.env.staging HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.staging",
"evidence_snippet": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:50 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.test.local
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.test.local UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.test.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.test.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.test.local HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.test.local HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100
Requête brute (extrait)
GET /.env.test.local HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "local",
"http_ua_hash": "1e87ffea5654101b4de6efaf2d6659424d4315d1",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "7037545cd402c24a5b36416f2296a29dfb758ccf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.251703079507166,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "aed775bfea3fe3a73574089b3664f8717cbe68e5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ad82fd5622889299602e148bf3c011b2",
"payload_hash": "36ded0aaaa9beba4c0a33fecc28d961f",
"path_pattern_hash": "dcacd6523bc1054dd8758815dd403309"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.test.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100",
"method": "GET",
"path": "\/.env.test.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test.local HTTP\/1.1",
"request_sample": "GET \/.env.test.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.test.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100",
"evidence": {
"method": "GET",
"path": "\/.env.test.local",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test.local HTTP\/1.1",
"request_sample": "GET \/.env.test.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.test.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b8c3c43d98d97b9f10b5fa557169480faa640af",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test.local",
"request_line": "GET \/.env.test.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.test.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test.local",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test.local",
"request_line": "GET \/.env.test.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test.local",
"evidence_snippet": "GET \/.env.test.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:50 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.test
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.test UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.test
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.test
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.test HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.test HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KH
Requête brute (extrait)
GET /.env.test HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "test",
"http_ua_hash": "a1316cfc976f46ddc2aa5e170373ead4f3160a76",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "4e40a92f813d5ab41a0033a3846a1a977ff1de23",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 237,
"payload_entropy": 5.324726234860633,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "a2c5ceaf7c443a667115afeaf8db4f18d3f88d3a",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bfe94685d69858c7fc6ebd565901037b",
"payload_hash": "87573e4080bfe851ea4fb5505c263685",
"path_pattern_hash": "d0f775cf96d71b1d76da4d08e462f07a"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KH",
"method": "GET",
"path": "\/.env.test",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test HTTP\/1.1",
"request_sample": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KH",
"evidence": {
"method": "GET",
"path": "\/.env.test",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test HTTP\/1.1",
"request_sample": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KH",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e61a39716110b78cb33282e4d03f227a7dc21d58",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test",
"request_line": "GET \/.env.test HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KH",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test",
"request_line": "GET \/.env.test HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test",
"evidence_snippet": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KH",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:50 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.uat
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.uat UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.uat
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.uat
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.uat HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.uat HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Fir
Requête brute (extrait)
GET /.env.uat HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "uat",
"http_ua_hash": "1e87ffea5654101b4de6efaf2d6659424d4315d1",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "66d1899261b7971a064fb81964052eae4ab44ccb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 202,
"payload_entropy": 5.276326349642565,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "d51fda3e4fd2f135aed6d19a796a43f135a71192",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ad82fd5622889299602e148bf3c011b2",
"payload_hash": "1aa71e118beb2e740386c185535c5c10",
"path_pattern_hash": "ae4cb14da8dffdd0fce54bdc9802bc13"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.uat HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fir",
"method": "GET",
"path": "\/.env.uat",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.uat HTTP\/1.1",
"request_sample": "GET \/.env.uat HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.uat HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fir",
"evidence": {
"method": "GET",
"path": "\/.env.uat",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.uat HTTP\/1.1",
"request_sample": "GET \/.env.uat HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.uat HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fir",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed599cf3e5a6e2fd236ef7b1d5ef3f53225bdb29",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.uat",
"request_line": "GET \/.env.uat HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.uat HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fir",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.uat",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.uat",
"request_line": "GET \/.env.uat HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.uat",
"evidence_snippet": "GET \/.env.uat HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fir",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:26 UTC
TCP
553
—
Sonde port
Sonde port · port 553 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
553
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": null,
"app_proto": null,
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "b8ecacd2876821def8febf7f4e992403fcf329cc",
"event_fingerprint": "8ab5ed9eb034d31c81dbda975e6fbdc29c468db6",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 553,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2799be40ab592808bb2b267de480a16e34cac662",
"protocol_details": {
"port": 553
},
"attack_vector": "Sonde port \u00b7 port 553 \u00b7 (sonde \/ probe)",
"target_port_label": "553",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 553
},
"attack_vector": "Sonde port \u00b7 port 553 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "553",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 10:01:19 UTC
TCP
553
—
Sonde port
Sonde port · port 553 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
553
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": null,
"app_proto": null,
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "b8ecacd2876821def8febf7f4e992403fcf329cc",
"event_fingerprint": "8ab5ed9eb034d31c81dbda975e6fbdc29c468db6",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 553,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2799be40ab592808bb2b267de480a16e34cac662",
"protocol_details": {
"port": 553
},
"attack_vector": "Sonde port \u00b7 port 553 \u00b7 (sonde \/ probe)",
"target_port_label": "553",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 553
},
"attack_vector": "Sonde port \u00b7 port 553 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "553",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:553",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 10:01:16 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.gcp
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.gcp UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.gcp
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.gcp
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.gcp HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.gcp HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l
Requête brute (extrait)
GET /.env.gcp HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "gcp",
"http_ua_hash": "34135990e474ac0a8e18c08839d6076fe8f1a196",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "868db543c5827064182ab20b5522d6d01c409d2c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 233,
"payload_entropy": 5.411233228451141,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "6104ffe6a95ee31bae4af12b2a2198b56d293e9b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93471414a280d667b4d37824ff5e6b20",
"payload_hash": "0f0878f50956c35dc5bed6042135b8e7",
"path_pattern_hash": "b19db4db322c22f4290993cbf4ea22e1"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.gcp HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, l",
"method": "GET",
"path": "\/.env.gcp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.gcp HTTP\/1.1",
"request_sample": "GET \/.env.gcp HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.gcp HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, l",
"evidence": {
"method": "GET",
"path": "\/.env.gcp",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.gcp HTTP\/1.1",
"request_sample": "GET \/.env.gcp HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.gcp HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, l",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ab27cffb679205f57da56931b0bb9ea4b21de13",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.gcp",
"request_line": "GET \/.env.gcp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.gcp HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, l",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.gcp",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.gcp",
"request_line": "GET \/.env.gcp HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.gcp",
"evidence_snippet": "GET \/.env.gcp HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, l",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:16 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.github-actions
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.github-actions UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.github-actions
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.github-actions
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.github-actions HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.github-actions HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/60
Requête brute (extrait)
GET /.env.github-actions HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "github-actions",
"http_ua_hash": "a1316cfc976f46ddc2aa5e170373ead4f3160a76",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "19dae3c39aad7e71a9fc38a0478c17fa2a137525",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 247,
"payload_entropy": 5.354667322918741,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "ca12ce5a0b51ffdf64f58a2d21eb48449ce57363",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bfe94685d69858c7fc6ebd565901037b",
"payload_hash": "a81511af4dd1b28a1903847e90f0ea01",
"path_pattern_hash": "1f5221bf3623fb192d36be7284833859"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.github-actions HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/60",
"method": "GET",
"path": "\/.env.github-actions",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.github-actions HTTP\/1.1",
"request_sample": "GET \/.env.github-actions HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.github-actions HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/60",
"evidence": {
"method": "GET",
"path": "\/.env.github-actions",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.github-actions HTTP\/1.1",
"request_sample": "GET \/.env.github-actions HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.github-actions HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/60",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "00fffcc1413b08f0722d97e7b23ba6db92922dfa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.github-actions",
"request_line": "GET \/.env.github-actions HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.github-actions HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/60",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.github-actions",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.github-actions",
"request_line": "GET \/.env.github-actions HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.github-actions",
"evidence_snippet": "GET \/.env.github-actions HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/60",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:16 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.example
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.example UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.example
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.example
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.example HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.example HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36
Requête brute (extrait)
GET /.env.example HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "example",
"http_ua_hash": "040a89826d3eb8f60f68abe05208a91b116b5286",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "080963ef62d711207d0e68706f04d0705ec4d7fa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 242,
"payload_entropy": 5.435241642464267,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "546cf895d4b530dd15a5eabbf3368e0726a2f92c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b24c868eb88f09716d34b010b594ad74",
"payload_hash": "f94bad44c480e16ae94991809f5cef55",
"path_pattern_hash": "f8bf22cb3ab23601599be7f21fa00aee"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.example HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 ",
"method": "GET",
"path": "\/.env.example",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.example HTTP\/1.1",
"request_sample": "GET \/.env.example HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.example HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/.env.example",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.example HTTP\/1.1",
"request_sample": "GET \/.env.example HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.example HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8e7ac7d8c5fc8e6f24bbd3af4238e04f25972d85",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.example",
"request_line": "GET \/.env.example HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.example HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.example",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.example",
"request_line": "GET \/.env.example HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.example",
"evidence_snippet": "GET \/.env.example HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:16 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.heroku
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.heroku UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.heroku
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.heroku
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.heroku HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.heroku HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101
Requête brute (extrait)
GET /.env.heroku HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "heroku",
"http_ua_hash": "1e87ffea5654101b4de6efaf2d6659424d4315d1",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "2ef42725386aceb82073e2ffb723eed12a4fd677",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 205,
"payload_entropy": 5.297730428069575,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "224772be277b448e91c7495e54e2d160c264b20a",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ad82fd5622889299602e148bf3c011b2",
"payload_hash": "db39b0173f0ac921eee68608780f3917",
"path_pattern_hash": "9356f306774557bbe7d47776e2e194ca"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.heroku HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 ",
"method": "GET",
"path": "\/.env.heroku",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.heroku HTTP\/1.1",
"request_sample": "GET \/.env.heroku HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.heroku HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101",
"evidence": {
"method": "GET",
"path": "\/.env.heroku",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.heroku HTTP\/1.1",
"request_sample": "GET \/.env.heroku HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.heroku HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8efb0fa674221e10e65514c4c6ace6e932c4cdc2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.heroku",
"request_line": "GET \/.env.heroku HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.heroku HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.heroku",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.heroku",
"request_line": "GET \/.env.heroku HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.heroku",
"evidence_snippet": "GET \/.env.heroku HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:12 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.dev
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.dev UA Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefo…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.dev
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.dev
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.dev HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.dev HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0
Requête brute (extrait)
GET /.env.dev HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "dev",
"http_ua_hash": "880d0c120dbf4497314046742f2cb6dbd4be704d",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "a499321530f3e4ddd283e6792cf6d67b1e7cfe88",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 192,
"payload_entropy": 5.305371260098269,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "ff4d3a80cacf5828e0b0e968c44787d5e11b55d5",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a59685e43b0ef4fb9f3e6765d2231094",
"payload_hash": "651a916e217a1b2992e8221d87c9f755",
"path_pattern_hash": "ceb221ca10f5b573c09ea91320781e08"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"method": "GET",
"path": "\/.env.dev",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.dev HTTP\/1.1",
"request_sample": "GET \/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"evidence": {
"method": "GET",
"path": "\/.env.dev",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.dev HTTP\/1.1",
"request_sample": "GET \/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6428fd89c3b6628bf936fc27b76fdb41bca01153",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.dev",
"request_line": "GET \/.env.dev HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.dev",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.dev",
"request_line": "GET \/.env.dev HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.dev",
"evidence_snippet": "GET \/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:126.0) Gecko\/20100101 Firefox\/126.0",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:12 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.development.local
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.development.local UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.development.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.development.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.development.local HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.development.local HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /.env.development.local HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "local",
"http_ua_hash": "e0871089d7d4e6ad8303458c123cbcd9b591518a",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "44b27fcf42134edd5dc872c2c6f931dc026ceb76",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 237,
"payload_entropy": 5.439067177275549,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "f47ce98f89d29d4656a2492d9a490169c6438d9f",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7bfbb51b235934598654bef5cad77b9b",
"payload_hash": "bacf02bac645dfb7fb6abc43b8782d0f",
"path_pattern_hash": "66b5346fea2c0f881a6004f5150ea85e"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.development.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"method": "GET",
"path": "\/.env.development.local",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.development.local HTTP\/1.1",
"request_sample": "GET \/.env.development.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.development.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"evidence": {
"method": "GET",
"path": "\/.env.development.local",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.development.local HTTP\/1.1",
"request_sample": "GET \/.env.development.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.development.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e0a17b33be23583705c698b336fd6ee39f4c7b6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.development.local",
"request_line": "GET \/.env.development.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.development.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.development.local",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.development.local",
"request_line": "GET \/.env.development.local HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.development.local",
"evidence_snippet": "GET \/.env.development.local HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:12 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.development
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.development UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.development
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.development
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.development HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.development HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537
Requête brute (extrait)
GET /.env.development HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "development",
"http_ua_hash": "040a89826d3eb8f60f68abe05208a91b116b5286",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "8a4e51701d196d7852353e13bcdd4450138c4d04",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 246,
"payload_entropy": 5.419579653239088,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "9d2acaf8c754ffac8d2a75deab7b90a449793780",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b24c868eb88f09716d34b010b594ad74",
"payload_hash": "2f752554f05850b54c274ee971c05e81",
"path_pattern_hash": "c0c440edf0616e70222e5cd82887a202"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.development HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"method": "GET",
"path": "\/.env.development",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.development HTTP\/1.1",
"request_sample": "GET \/.env.development HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.development HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/.env.development",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.development HTTP\/1.1",
"request_sample": "GET \/.env.development HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.development HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "12a2d8753a424d6b2c65283c1ae219cd137f09dd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.development",
"request_line": "GET \/.env.development HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.development HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.development",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.development",
"request_line": "GET \/.env.development HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.development",
"evidence_snippet": "GET \/.env.development HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:12 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.docker
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.docker UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.docker
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.docker
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.docker HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.docker HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML
Requête brute (extrait)
GET /.env.docker HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "docker",
"http_ua_hash": "34135990e474ac0a8e18c08839d6076fe8f1a196",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "fffaa1342f06e8670d7edda0bc9461e93e4a0f1f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 236,
"payload_entropy": 5.411171222989191,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "c3de717896ebf870de544cac06cf9697c737d318",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93471414a280d667b4d37824ff5e6b20",
"payload_hash": "c4da9d42cb7ddd310bb7be27f4a08327",
"path_pattern_hash": "4424df1cf14166f6194446e711e46b03"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.docker HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML",
"method": "GET",
"path": "\/.env.docker",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.docker HTTP\/1.1",
"request_sample": "GET \/.env.docker HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.docker HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML",
"evidence": {
"method": "GET",
"path": "\/.env.docker",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.docker HTTP\/1.1",
"request_sample": "GET \/.env.docker HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.docker HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2b7238c118e6fd9e607478b447d3f8ceaef3df46",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.docker",
"request_line": "GET \/.env.docker HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.docker HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.docker",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.docker",
"request_line": "GET \/.env.docker HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.docker",
"evidence_snippet": "GET \/.env.docker HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:10 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.azure
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.azure UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.azure
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.azure
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.azure HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.azure HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (K
Requête brute (extrait)
GET /.env.azure HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "azure",
"http_ua_hash": "a1316cfc976f46ddc2aa5e170373ead4f3160a76",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "aec6dcc3b6f4b3f44170d4aa77b266a95266ef80",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 238,
"payload_entropy": 5.359698222614,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "52470626230b7d0adeb666d56be34fffbe9afe61",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bfe94685d69858c7fc6ebd565901037b",
"payload_hash": "5cf664a15f916299126f2e4624777442",
"path_pattern_hash": "beffcd3c237c99e5c56a3ccfd20b0dd3"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.azure HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (K",
"method": "GET",
"path": "\/.env.azure",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.azure HTTP\/1.1",
"request_sample": "GET \/.env.azure HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.azure HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (K",
"evidence": {
"method": "GET",
"path": "\/.env.azure",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.azure HTTP\/1.1",
"request_sample": "GET \/.env.azure HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.azure HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (K",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f8719dcd81c48e95024f8469bfe3e6139b5538c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.azure",
"request_line": "GET \/.env.azure HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.azure HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (K",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.azure",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.azure",
"request_line": "GET \/.env.azure HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.azure",
"evidence_snippet": "GET \/.env.azure HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (K",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:10 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.ci
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.ci UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.ci
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.ci
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.ci HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.ci HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Fire
Requête brute (extrait)
GET /.env.ci HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ci",
"http_ua_hash": "1e87ffea5654101b4de6efaf2d6659424d4315d1",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "a66db66bf53b01b301b8d0e3bec0a69a5b2f4f1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 201,
"payload_entropy": 5.250416771596963,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "031bd4612219d44b3a15f69b793002751cdb2141",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ad82fd5622889299602e148bf3c011b2",
"payload_hash": "d533233cab97f1e2261b17323ab69af3",
"path_pattern_hash": "50f9d36c86f775badf5b5642056ce5d6"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.ci HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fire",
"method": "GET",
"path": "\/.env.ci",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.ci HTTP\/1.1",
"request_sample": "GET \/.env.ci HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.ci HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fire",
"evidence": {
"method": "GET",
"path": "\/.env.ci",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.ci HTTP\/1.1",
"request_sample": "GET \/.env.ci HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.ci HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fire",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a1460485561a87e38d9251decfeb0d6323db1ea5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.ci",
"request_line": "GET \/.env.ci HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.ci HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fire",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.ci",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.ci",
"request_line": "GET \/.env.ci HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.ci",
"evidence_snippet": "GET \/.env.ci HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Fire",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:10 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env.aws
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.aws UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.aws
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env.aws
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.aws HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.aws HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHT
Requête brute (extrait)
GET /.env.aws HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "aws",
"http_ua_hash": "a1316cfc976f46ddc2aa5e170373ead4f3160a76",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "076b05e1b491aec88848a80984fd2fc01270096f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 236,
"payload_entropy": 5.354197783718224,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7b991f991ca78c83abc0aebc314d319e411798b7",
"event_fingerprint": "adfb39162cf48c28f794c234dbfd026496b99769",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bfe94685d69858c7fc6ebd565901037b",
"payload_hash": "79205a8ab0cb5c71b909468b4081fde8",
"path_pattern_hash": "2b3ffe3780b558cb9c98d745388bda06"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env.aws HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHT",
"method": "GET",
"path": "\/.env.aws",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.aws HTTP\/1.1",
"request_sample": "GET \/.env.aws HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.aws HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHT",
"evidence": {
"method": "GET",
"path": "\/.env.aws",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.aws HTTP\/1.1",
"request_sample": "GET \/.env.aws HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env.aws HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a2c65d285e62d53652d6ddf48e2f0eb196bc647e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.aws",
"request_line": "GET \/.env.aws HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.aws HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHT",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.aws",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.aws",
"request_line": "GET \/.env.aws HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.aws",
"evidence_snippet": "GET \/.env.aws HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHT",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path"
]
}
16/07/2026 10:01:10 UTC
TCP
553 · HTTP
Sonde fichier configuration
config file probe · via HTTP:553 · (tentative d'exploit) · → /.env
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /.env HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "040a89826d3eb8f60f68abe05208a91b116b5286",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "9ee0d3f55b39072ba6bec6203d26e470be80afdc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 234,
"payload_entropy": 5.427107846955792,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.3,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 61,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "70506d6b22a6aded78a91df699fb98fd5804b856",
"event_fingerprint": "1a7b981e05c07bb66babf43df695c4ada2601c5f",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b24c868eb88f09716d34b010b594ad74",
"payload_hash": "c5e509f8cdda74c160d699aa10b66092",
"path_pattern_hash": "aef81e7735de8f42b73e111497498c8b"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, ",
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env HTTP\/1.1",
"request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0beece1c5c9a05db008da2d0ccb289772b9e0e00",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML,",
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env",
"request_line": "GET \/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env",
"evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML,",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_env",
"http_sensitive_path"
]
}
16/07/2026 10:01:09 UTC
TCP
553 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:553 · (tentative d'exploit) · → /.development.env
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /.development.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
Cible HTTP
GET
/.development.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
553
Chemin / cible
/.development.env
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 43
Confiance : Confiance 62 % — 2 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.development.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.development.env HTTP/1.1
Host: 62.3.50.33:553
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537
Requête brute (extrait)
GET /.development.env HTTP/1.1 Host: 62.3.50.33:553 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "040a89826d3eb8f60f68abe05208a91b116b5286",
"http_host_hash": "8db7c7f43e48a17ae6e25a0c1b2408d69d518c64",
"http_target_hash": "b8879d714f32c0b133cf2915a3215aab79ccfd20",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 246,
"payload_entropy": 5.419579653239088,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 43,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1622e9e4b5d5ba4de1dab3a913aca8a1c4e2975e",
"event_fingerprint": "cafa865adea82982fa909f403712a4c74649cacd",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 43,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b24c868eb88f09716d34b010b594ad74",
"payload_hash": "8c42d8a8c5986b5453f606887c59ff30",
"path_pattern_hash": "69f2f37f3d95441ea966a8a1ab9c67bd"
},
"target_context": {
"dst_port": 553,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"method": "GET",
"path": "\/.development.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.development.env HTTP\/1.1",
"request_sample": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/.development.env",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.development.env HTTP\/1.1",
"request_sample": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d74e02ddd7e44b918589a404681c95f0aeef763b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.development.env",
"request_line": "GET \/.development.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"attack_vector": "exploit attempt \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.development.env",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 43,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.development.env",
"request_line": "GET \/.development.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36",
"port": 553,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:553 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.development.env",
"evidence_snippet": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:553\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit\/537",
"target_port_label": "553 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"tls"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
16/07/2026 10:01:06 UTC
TCP
553 · TLS
Sonde PostgreSQL
postgres probe · via TLS:553 · (sonde / probe)
Élevée
Faible · 35
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
JA3 2079bcc000c9a54e
Émulateur
TLS
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
553
Chemin / cible
—
Service
TLS
Payload
�5c�e���r�2i� z$��U�p��W��k�1 0w�h�y�0�N�.hEUk�Z�����G�� �+�/�,�0̨̩� �� �� � �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
�5c�e���r�2i� z$��U�p��W��k�1 0w�h�y�0�N�.hEUk�Z�����G�� �+�/�,�0̨̩� ��
�� � �
Requête brute (extrait)
�5c�e���r�2i� z$��U�p��W��k�1 0w�h�y�0�N�.hEUk�Z�����G�� �+�/�,�0̨̩� �� �� � � 2 + 3 & $ ��UB�lA7� ,��5�%� �U� �
Meta JSON brut
{
"tls_ja3_hash": "2079bcc000c9a54e0784733c0142d140",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 1,
"bytes_in": 263,
"payload_entropy": 5.733961816656494,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "tls",
"app_proto": "tls",
"asn": 208137,
"country": "TW",
"dst_port": 553,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 35,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ba31128cdc357f2659f5b0b4b32156ffa1c37a1e",
"event_fingerprint": "4a3830abb1eda878908e68791649e90c747858b5",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "2079bcc000c9a54e0784733c0142d140",
"payload_hash": "fd58ea4929be40a17649dfccdb2d8b8a",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 553,
"service": "tls",
"service_name": "tls",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00035c\u0016\ufffde\ufffd\ufffd\ufffdr\u0010\u0004\u0015\ufffd2i\ufffd\u001fz$\ufffd\ufffdU\ufffdp\ufffd\ufffdW\ufffd\ufffdk\ufffd1 \u03780w\ufffdh\ufffdy\ufffd0\ufffdN\ufffd.hEUk\ufffd\u001bZ\ufffd\ufffd\u001b\ufffd\ufffd\u000f\ufffdG\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00035c\u0016\ufffde\ufffd\ufffd\ufffdr\u0010\u0004\u0015\ufffd2i\ufffd\u001fz$\ufffd\ufffdU\ufffdp\ufffd\ufffdW\ufffd\ufffdk\ufffd1 \u03780w\ufffdh\ufffdy\ufffd0\ufffdN\ufffd.hEUk\ufffd\u001bZ\ufffd\ufffd\u001b\ufffd\ufffd\u000f\ufffdG\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdUB\ufffdlA7\ufffd\r,\ufffd\ufffd5\b\ufffd%\u0013\ufffd\u001f\ufffdU\ufffd\n\ufffd",
"payload_snippet": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00035c\u0016\ufffde\ufffd\ufffd\ufffdr\u0010\u0004\u0015\ufffd2i\ufffd\u001fz$\ufffd\ufffdU\ufffdp\ufffd\ufffdW\ufffd\ufffdk\ufffd1 \u03780w\ufffdh\ufffdy\ufffd0\ufffdN\ufffd.hEUk\ufffd\u001bZ\ufffd\ufffd\u001b\ufffd\ufffd\u000f\ufffdG\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4786ae6ba7d40c40afdfb2f29621ac207c24f089",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00035c\u0016\ufffde\ufffd\ufffd\ufffdr\u0010\u0004\u0015\ufffd2i\ufffd\u001fz$\ufffd\ufffdU\ufffdp\ufffd\ufffdW\ufffd\ufffdk\ufffd1 \u03780w\ufffdh\ufffdy\ufffd0\ufffdN\ufffd.hEUk\ufffd\u001bZ\ufffd\ufffd\u001b\ufffd\ufffd\u000f\ufffdG\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000",
"tls_ja3": "2079bcc000c9a54e0784733c0142d140",
"port": 553,
"service": "tls",
"service_label_fr": "TLS"
},
"evidence_snippet": "\ufffd5c\ufffde\ufffd\ufffd\ufffdr\ufffd2i\ufffdz$\ufffd\ufffdU\ufffdp\ufffd\ufffdW\ufffd\ufffdk\ufffd1 \u03780w\ufffdh\ufffdy\ufffd0\ufffdN\ufffd.hEUk\ufffdZ\ufffd\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd",
"attack_vector": "postgres probe \u00b7 via TLS:553 \u00b7 (sonde \/ probe)",
"target_port_label": "553 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "tls",
"service_label_fr": "TLS",
"dst_port": 553,
"protocol_emulated": null,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-tls",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0001\u0002\u0001\u0000\u0000\ufffd\u0003\u00035c\u0016\ufffde\ufffd\ufffd\ufffdr\u0010\u0004\u0015\ufffd2i\ufffd\u001fz$\ufffd\ufffdU\ufffdp\ufffd\ufffdW\ufffd\ufffdk\ufffd1 \u03780w\ufffdh\ufffdy\ufffd0\ufffdN\ufffd.hEUk\ufffd\u001bZ\ufffd\ufffd\u001b\ufffd\ufffd\u000f\ufffdG\ufffd\ufffd\u0000\u001c\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\ufffd\u0012\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000",
"tls_ja3": "2079bcc000c9a54e0784733c0142d140",
"port": 553,
"service": "tls",
"service_label_fr": "TLS"
},
"attack_vector": "postgres probe \u00b7 via TLS:553 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd5c\ufffde\ufffd\ufffd\ufffdr\ufffd2i\ufffdz$\ufffd\ufffdU\ufffdp\ufffd\ufffdW\ufffd\ufffdk\ufffd1 \u03780w\ufffdh\ufffdy\ufffd0\ufffdN\ufffd.hEUk\ufffdZ\ufffd\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd",
"target_port_label": "553 \u00b7 TLS",
"emulator_service": "tls",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "553"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
14/07/2026 11:20:44 UTC
TCP
8080 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:8080 · (tentative d'exploit) · → /.development.env
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /.development.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/.development.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/.development.env
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 43
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.development.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.development.env HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Requête brute (extrait)
GET /.development.env HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "env",
"http_ua_hash": "34135990e474ac0a8e18c08839d6076fe8f1a196",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "b8879d714f32c0b133cf2915a3215aab79ccfd20",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 242,
"payload_entropy": 5.429271732946084,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "TW",
"dst_port": 8080,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 43,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "57f088a40ee12788bdcf96d0d3ffc1707c32a99e",
"event_fingerprint": "9842a265acf329b7fc4c84530be19a57fee7aac4",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93471414a280d667b4d37824ff5e6b20",
"payload_hash": "54f0744b7c59a85b6aa7c8d8fdfd418c",
"path_pattern_hash": "69f2f37f3d95441ea966a8a1ab9c67bd"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 ",
"method": "GET",
"path": "\/.development.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.development.env HTTP\/1.1",
"request_sample": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/.development.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.development.env HTTP\/1.1",
"request_sample": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb4cf9e15cd8b67d178fd2f5a802e94850dc50e3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.development.env",
"request_line": "GET \/.development.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"attack_vector": "exploit attempt \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.development.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/.development.env",
"request_line": "GET \/.development.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.development.env",
"evidence_snippet": "GET \/.development.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 96
}
11/07/2026 08:58:15 UTC
TCP
5001 · UPNP TCP
Botnet Mozi
mozi pattern · via UPNP TCP:5001 · (commande & contrôle)
Élevée
Faible · 36
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
GET /.circleci/settings.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /.circleci/settings.json HTTP/1.1
Host: 62.3.50.33:5001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/
Requête brute (extrait)
GET /.circleci/settings.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 249,
"payload_entropy": 5.382079302268567,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 208137,
"country": "TW",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 36,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "026f36b3ffe414862f6c505b08a38f2a9ee910e5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "75fbd6c71a1266ec38e4037b5b473b9b",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 36
},
"payload_preview": "GET \/.circleci\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"request_sample": "GET \/.circleci\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"evidence": {
"request_sample": "GET \/.circleci\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bd7ae677a7547b70e22396d6d36800762215ebc1",
"protocol_details": {
"payload_preview": "GET \/.circleci\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "GET \/.circleci\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via UPNP TCP",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/.circleci\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/.circleci\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
11/07/2026 08:58:15 UTC
TCP
5001 · UPNP TCP
Botnet Mozi
mozi pattern · via UPNP TCP:5001 · (commande & contrôle)
Élevée
Faible · 36
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
GET /.circleci/.settings.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWeb
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /.circleci/.settings.json HTTP/1.1
Host: 62.3.50.33:5001
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWeb
Requête brute (extrait)
GET /.circleci/.settings.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 253,
"payload_entropy": 5.302520577106503,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 208137,
"country": "TW",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 36,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "026f36b3ffe414862f6c505b08a38f2a9ee910e5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "63002439e460fde37ca1ee22c30aa407",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 36
},
"payload_preview": "GET \/.circleci\/.settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWeb",
"request_sample": "GET \/.circleci\/.settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/.settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWeb",
"evidence": {
"request_sample": "GET \/.circleci\/.settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/.settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWeb",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f8739e148d3d6283870f25e9b33e54bd4fb44c3",
"protocol_details": {
"payload_preview": "GET \/.circleci\/.settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWeb",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "GET \/.circleci\/.settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWeb",
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via UPNP TCP",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/.circleci\/.settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWeb",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/.circleci\/.settings.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWeb",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
],
"behavior_alert_count": 2,
"behavior_priority": 72
}
11/07/2026 08:58:10 UTC
TCP
5001 · UPNP TCP
Botnet Mozi
mozi pattern · via UPNP TCP:5001 · (commande & contrôle)
Élevée
Faible · 36
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
GET /.circleci/.env.local.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWe
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /.circleci/.env.local.json HTTP/1.1
Host: 62.3.50.33:5001
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWe
Requête brute (extrait)
GET /.circleci/.env.local.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 254,
"payload_entropy": 5.316236795430656,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 208137,
"country": "TW",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 36,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "026f36b3ffe414862f6c505b08a38f2a9ee910e5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "14c6fd2962cfb7a193a006ca20dd5eb0",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 36
},
"payload_preview": "GET \/.circleci\/.env.local.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWe",
"request_sample": "GET \/.circleci\/.env.local.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/.env.local.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWe",
"evidence": {
"request_sample": "GET \/.circleci\/.env.local.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/.env.local.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWe",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d96ea6878cedf6c44b704e2d7b3612154c45e56d",
"protocol_details": {
"payload_preview": "GET \/.circleci\/.env.local.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWe",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "GET \/.circleci\/.env.local.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWe",
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via UPNP TCP",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/.circleci\/.env.local.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWe",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/.circleci\/.env.local.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWe",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
11/07/2026 08:58:10 UTC
TCP
5001 · UPNP TCP
Botnet Mozi
mozi pattern · via UPNP TCP:5001 · (commande & contrôle)
Élevée
Faible · 36
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
GET /.circleci/mcp.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/2
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /.circleci/mcp.json HTTP/1.1
Host: 62.3.50.33:5001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/2
Requête brute (extrait)
GET /.circleci/mcp.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 213,
"payload_entropy": 5.261600227459513,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 208137,
"country": "TW",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 36,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "026f36b3ffe414862f6c505b08a38f2a9ee910e5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8448e7047b0ec4959befad7d9cc1e45b",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 36
},
"payload_preview": "GET \/.circleci\/mcp.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/2",
"request_sample": "GET \/.circleci\/mcp.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/mcp.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/2",
"evidence": {
"request_sample": "GET \/.circleci\/mcp.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/mcp.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/2",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7d5865f1d6b65758910e1e51f0aca3c78740371e",
"protocol_details": {
"payload_preview": "GET \/.circleci\/mcp.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/2",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "GET \/.circleci\/mcp.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/2",
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via UPNP TCP",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/.circleci\/mcp.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/2",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/.circleci\/mcp.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko\/2",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
11/07/2026 08:58:10 UTC
TCP
5001 · UPNP TCP
Botnet Mozi
mozi pattern · via UPNP TCP:5001 · (commande & contrôle)
Élevée
Faible · 36
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
GET /.circleci/CLAUDE.md HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /.circleci/CLAUDE.md HTTP/1.1
Host: 62.3.50.33:5001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.
Requête brute (extrait)
GET /.circleci/CLAUDE.md HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 259,
"payload_entropy": 5.421296826414353,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 208137,
"country": "TW",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 36,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "026f36b3ffe414862f6c505b08a38f2a9ee910e5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f63042afb8ad72b615f2f5f7941e8d3c",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 36
},
"payload_preview": "GET \/.circleci\/CLAUDE.md HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"request_sample": "GET \/.circleci\/CLAUDE.md HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36 Edg\/124.0.0.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r",
"payload_snippet": "GET \/.circleci\/CLAUDE.md HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"evidence": {
"request_sample": "GET \/.circleci\/CLAUDE.md HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/124.0.0.0 Safari\/537.36 Edg\/124.0.0.0\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r",
"payload_snippet": "GET \/.circleci\/CLAUDE.md HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0da9c52c69454e5aaf949304e29c7d11e990823b",
"protocol_details": {
"payload_preview": "GET \/.circleci\/CLAUDE.md HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "GET \/.circleci\/CLAUDE.md HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via UPNP TCP",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/.circleci\/CLAUDE.md HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/.circleci\/CLAUDE.md HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
11/07/2026 08:58:10 UTC
TCP
5001 · UPNP TCP
Botnet Mozi
mozi pattern · via UPNP TCP:5001 · (commande & contrôle)
Élevée
Faible · 36
Détails
Voir
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
GET /.circleci/credentials.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleW
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 36
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /.circleci/credentials.json HTTP/1.1
Host: 62.3.50.33:5001
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleW
Requête brute (extrait)
GET /.circleci/credentials.json HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15 Accept: */* Accept-Encoding: identity Range: bytes=0-511
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 255,
"payload_entropy": 5.306022213479548,
"port_category": "registered",
"org": "Feo Prest SRL",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 208137,
"country": "TW",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 36,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "026f36b3ffe414862f6c505b08a38f2a9ee910e5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TW",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "703dae92ff476269dad5834bcb51ff52",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 36
},
"payload_preview": "GET \/.circleci\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleW",
"request_sample": "GET \/.circleci\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleW",
"evidence": {
"request_sample": "GET \/.circleci\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/17.5 Safari\/605.1.15\r\nAccept: *\/*\r\nAccept-Encoding: identity\r\nRange: bytes=0-511\r\n\r\n",
"payload_snippet": "GET \/.circleci\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleW",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c244762a9aa291ff87a0cbd35b0fc074fd038aad",
"protocol_details": {
"payload_preview": "GET \/.circleci\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleW",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "GET \/.circleci\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleW",
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via UPNP TCP",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 36
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 36,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/.circleci\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleW",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "mozi pattern \u00b7 via UPNP TCP:5001 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/.circleci\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 14_5) AppleW",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}