|
|
TCP |
88 · KERBEROS
|
kerberos
|
Botnet Mozi
mozi pattern · via KERBEROS:88 · (commande & contrôle)
|
Élevée
|
Faible · 38
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
GET / HTTP/1.1 Host: 62.3.50.33:88 User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; XT1562 Build/LPD23.118-12; wv) AppleWebKit/5
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 38
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:88
User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; XT1562 Build/LPD23.118-12; wv) AppleWebKit/5
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:88 User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; XT1562 Build/LPD23.118-12; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/50.0.2661.86 Mobile Safari/537.36 Liebao Accept: */* Accept-Language: en-US,en;q=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 317,
"payload_entropy": 5.498755671332017,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 208137,
"country": "DE",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "68890cc80ee52b8bd6dfeedd3db3b6108c4ecada",
"event_fingerprint": "26f82f2c92284ed572a3b340dbd905b8440e59b6",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88f1200f2b66e9c4012789d6bd41263c",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 38
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/5",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/50.0.2661.86 Mobile Safari\/537.36 Liebao\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/5",
"evidence": {
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/50.0.2661.86 Mobile Safari\/537.36 Liebao\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/5",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ae94702b9c143f179867e29e863d80623fefccb",
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/5",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/5",
"attack_vector": "mozi pattern \u00b7 via KERBEROS:88 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0011 \u2014 via KERBEROS",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/5",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "mozi pattern \u00b7 via KERBEROS:88 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/5",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Botnet Mozi
mozi pattern · via KERBEROS:88 · (commande & contrôle)
|
Élevée
|
Faible · 38
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0011
TA0011
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
GET /site.zip HTTP/1.1 Host: 62.3.50.33:88 User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; XT1562 Build/LPD23.118-12; wv) Apple
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 38
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /site.zip HTTP/1.1
Host: 62.3.50.33:88
User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; XT1562 Build/LPD23.118-12; wv) Apple
Requête brute (extrait)
GET /site.zip HTTP/1.1 Host: 62.3.50.33:88 User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; XT1562 Build/LPD23.118-12; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/50.0.2661.86 Mobile Safari/537.36 Liebao Accept: */* Accept-Language: en-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 301,
"payload_entropy": 5.513350204844398,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 208137,
"country": "DE",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "68890cc80ee52b8bd6dfeedd3db3b6108c4ecada",
"event_fingerprint": "26f82f2c92284ed572a3b340dbd905b8440e59b6",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "45e29989399122ff1e51f15e0fe8e644",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 38
},
"payload_preview": "GET \/site.zip HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) Apple",
"request_sample": "GET \/site.zip HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/50.0.2661.86 Mobile Safari\/537.36 Liebao\r\nAccept: *\/*\r\nAccept-Language: en-",
"payload_snippet": "GET \/site.zip HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) Apple",
"evidence": {
"request_sample": "GET \/site.zip HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/50.0.2661.86 Mobile Safari\/537.36 Liebao\r\nAccept: *\/*\r\nAccept-Language: en-",
"payload_snippet": "GET \/site.zip HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) Apple",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07dba8e543d4fb2ad6767709e4a5ce2518458304",
"protocol_details": {
"payload_preview": "GET \/site.zip HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) Apple",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "GET \/site.zip HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) Apple",
"attack_vector": "mozi pattern \u00b7 via KERBEROS:88 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0011 \u2014 via KERBEROS",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 38
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "GET \/site.zip HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) Apple",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "mozi pattern \u00b7 via KERBEROS:88 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/site.zip HTTP\/1.1\r\nHost: 62.3.50.33:88\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1.1; XT1562 Build\/LPD23.118-12; wv) Apple",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde Kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 208137,
"country": "DE",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "fe65256267055ff3741cb3e41e97d623e066dba9",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ebeb7af8f30f380ff10b2e6fd901d56429d2e157",
"protocol_details": {
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde PostgreSQL
postgres probe · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ��IQ�L1Q� ���b�d� y�Zb��l�RO��;A W,X՞ 贴�� ��X�G��U� �+�/�,�0̨̩� �� � u �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��IQ�L1Q� ���b�d� y�Zb��l�RO��;A W,X՞ 贴�� ��X�G��U� �+�/�,�0̨̩� ��
� u �
Requête brute (extrait)
� ��IQ�L1Q� ���b�d� y�Zb��l�RO��;A W,X՞ 贴�� ��X�G��U� �+�/�,�0̨̩� �� � u � ��� 2 h2http/1.1 + 3����>V
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 1398,
"payload_entropy": 7.706600638379809,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 208137,
"country": "DE",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "015c69af83aa6ba792e343f495145800",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdIQ\ufffdL1Q\ufffd\u001e\ufffd\ufffd\ufffdb\ufffdd\ufffd\ty\ufffdZb\ufffd\ufffd\u0015l\ufffdRO\ufffd\ufffd;A W,\u000f\u0014X\u055e \u0000\u8d34\ufffd\ufffd\u001f\ufffd\ufffd\u0010X\u000e\u0003\ufffdG\ufffd\ufffdU\uda5f\ude8c\ufffd\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdIQ\ufffdL1Q\ufffd\u001e\ufffd\ufffd\ufffdb\ufffdd\ufffd\ty\ufffdZb\ufffd\ufffd\u0015l\ufffdRO\ufffd\ufffd;A W,\u000f\u0014X\u055e \u0000\u8d34\ufffd\ufffd\u001f\ufffd\ufffd\u0010X\u000e\u0003\ufffdG\ufffd\ufffdU\uda5f\ude8c\ufffd\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd>V\u000f",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdIQ\ufffdL1Q\ufffd\u001e\ufffd\ufffd\ufffdb\ufffdd\ufffd\ty\ufffdZb\ufffd\ufffd\u0015l\ufffdRO\ufffd\ufffd;A W,\u000f\u0014X\u055e \u0000\u8d34\ufffd\ufffd\u001f\ufffd\ufffd\u0010X\u000e\u0003\ufffdG\ufffd\ufffdU\uda5f\ude8c\ufffd\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bd174dc1dccacfc794cf5635dcff27b36d0948d3",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdIQ\ufffdL1Q\ufffd\u001e\ufffd\ufffd\ufffdb\ufffdd\ufffd\ty\ufffdZb\ufffd\ufffd\u0015l\ufffdRO\ufffd\ufffd;A W,\u000f\u0014X\u055e \u0000\u8d34\ufffd\ufffd\u001f\ufffd\ufffd\u0010X\u000e\u0003\ufffdG\ufffd\ufffdU\uda5f\ude8c\ufffd\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdIQ\ufffdL1Q\ufffd\ufffd\ufffd\ufffdb\ufffdd\ufffd\ty\ufffdZb\ufffd\ufffdl\ufffdRO\ufffd\ufffd;A W,X\u055e \u8d34\ufffd\ufffd\ufffd\ufffdX\ufffdG\ufffd\ufffdU\uda5f\ude8c\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdu\ufffd",
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdIQ\ufffdL1Q\ufffd\u001e\ufffd\ufffd\ufffdb\ufffdd\ufffd\ty\ufffdZb\ufffd\ufffd\u0015l\ufffdRO\ufffd\ufffd;A W,\u000f\u0014X\u055e \u0000\u8d34\ufffd\ufffd\u001f\ufffd\ufffd\u0010X\u000e\u0003\ufffdG\ufffd\ufffdU\uda5f\ude8c\ufffd\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdIQ\ufffdL1Q\ufffd\ufffd\ufffd\ufffdb\ufffdd\ufffd\ty\ufffdZb\ufffd\ufffdl\ufffdRO\ufffd\ufffd;A W,X\u055e \u8d34\ufffd\ufffd\ufffd\ufffdX\ufffdG\ufffd\ufffdU\uda5f\ude8c\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdu\ufffd",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde PostgreSQL
postgres probe · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ��B��x�J�K�����K�mm.%�g�0�R��� �.t[���u��R6���*�'���w.L�dƷ �+�/�,�0̨̩� �� � u �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��B��x�J�K�����K�mm.%�g�0�R��� �.t[���u��R6���*�'���w.L�dƷ �+�/�,�0̨̩� ��
� u �
Requête brute (extrait)
� ��B��x�J�K�����K�mm.%�g�0�R��� �.t[���u��R6���*�'���w.L�dƷ �+�/�,�0̨̩� �� � u � ��� 2 h2http/1.1 + 3����pR]
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 1505,
"payload_entropy": 7.723655968449025,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 208137,
"country": "DE",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "889a4ebd11d32a98047301fe8ecacbb4",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffdx\ufffdJ\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffdK\b\ufffdmm.%\ufffdg\ufffd0\ufffdR\ufffd\u0018\u0018\ufffd\ufffd \ufffd.t[\ufffd\ufffd\u0016\ufffdu\ufffd\ufffdR6\ufffd\ufffd\ufffd*\ufffd'\ufffd\ufffd\ufffdw.L\u0007\ufffdd\u01b7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffdx\ufffdJ\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffdK\b\ufffdmm.%\ufffdg\ufffd0\ufffdR\ufffd\u0018\u0018\ufffd\ufffd \ufffd.t[\ufffd\ufffd\u0016\ufffdu\ufffd\ufffdR6\ufffd\ufffd\ufffd*\ufffd'\ufffd\ufffd\ufffdw.L\u0007\ufffdd\u01b7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdpR]",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffdx\ufffdJ\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffdK\b\ufffdmm.%\ufffdg\ufffd0\ufffdR\ufffd\u0018\u0018\ufffd\ufffd \ufffd.t[\ufffd\ufffd\u0016\ufffdu\ufffd\ufffdR6\ufffd\ufffd\ufffd*\ufffd'\ufffd\ufffd\ufffdw.L\u0007\ufffdd\u01b7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f82228ffa3a166c0d52fe828f6ae215d9ff92d76",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffdx\ufffdJ\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffdK\b\ufffdmm.%\ufffdg\ufffd0\ufffdR\ufffd\u0018\u0018\ufffd\ufffd \ufffd.t[\ufffd\ufffd\u0016\ufffdu\ufffd\ufffdR6\ufffd\ufffd\ufffd*\ufffd'\ufffd\ufffd\ufffdw.L\u0007\ufffdd\u01b7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffdB\ufffd\ufffdx\ufffdJ\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffdK\ufffdmm.%\ufffdg\ufffd0\ufffdR\ufffd\ufffd\ufffd \ufffd.t[\ufffd\ufffd\ufffdu\ufffd\ufffdR6\ufffd\ufffd\ufffd*\ufffd'\ufffd\ufffd\ufffdw.L\ufffdd\u01b7\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdu\ufffd",
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdB\ufffd\ufffdx\ufffdJ\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffdK\b\ufffdmm.%\ufffdg\ufffd0\ufffdR\ufffd\u0018\u0018\ufffd\ufffd \ufffd.t[\ufffd\ufffd\u0016\ufffdu\ufffd\ufffdR6\ufffd\ufffd\ufffd*\ufffd'\ufffd\ufffd\ufffdw.L\u0007\ufffdd\u01b7\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffdB\ufffd\ufffdx\ufffdJ\ufffdK\ufffd\ufffd\ufffd\ufffd\ufffdK\ufffdmm.%\ufffdg\ufffd0\ufffdR\ufffd\ufffd\ufffd \ufffd.t[\ufffd\ufffd\ufffdu\ufffd\ufffdR6\ufffd\ufffd\ufffd*\ufffd'\ufffd\ufffd\ufffdw.L\ufffdd\u01b7\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdu\ufffd",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde PostgreSQL
postgres probe · via KERBEROS:88 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Service
KERBEROS
Payload
� ����@^ui�;�n����Xx+�� �� Fr q�] ��#��с�d���-�ߗ��LB���:� �+�/�,�0̨̩� �� � u �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����@^ui�;�n����Xx+�� �� Fr q�] ��#��с�d���-�ߗ��LB���:� �+�/�,�0̨̩� ��
� u �
Requête brute (extrait)
� ����@^ui�;�n����Xx+�� �� Fr q�] ��#��с�d���-�ߗ��LB���:� �+�/�,�0̨̩� �� � u � ��� 2 h2http/1.1 + 3�����Q!
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"bytes_in": 1505,
"payload_entropy": 7.733688156688232,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 208137,
"country": "DE",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "81c15c62dc1c5fd148d35e27f449254e859b0aa4",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "06bf7e405ba8cb00e32c9285b640e09d",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd@^ui\ufffd;\ufffd\u0003n\ufffd\ufffd\ufffd\ufffdXx\u001b+\ufffd\ufffd\t\ufffd\ufffd\u0016\u001e\u0014Fr q\ufffd]\u0016\u000b\ufffd\ufffd#\ufffd\u000e\ufffd\u0001\u0441\ufffdd\ufffd\ufffd\ufffd-\ufffd\u07d7\ufffd\ufffdLB\ufffd\ufffd\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd@^ui\ufffd;\ufffd\u0003n\ufffd\ufffd\ufffd\ufffdXx\u001b+\ufffd\ufffd\t\ufffd\ufffd\u0016\u001e\u0014Fr q\ufffd]\u0016\u000b\ufffd\ufffd#\ufffd\u000e\ufffd\u0001\u0441\ufffdd\ufffd\ufffd\ufffd-\ufffd\u07d7\ufffd\ufffdLB\ufffd\ufffd\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdQ!",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd@^ui\ufffd;\ufffd\u0003n\ufffd\ufffd\ufffd\ufffdXx\u001b+\ufffd\ufffd\t\ufffd\ufffd\u0016\u001e\u0014Fr q\ufffd]\u0016\u000b\ufffd\ufffd#\ufffd\u000e\ufffd\u0001\u0441\ufffdd\ufffd\ufffd\ufffd-\ufffd\u07d7\ufffd\ufffdLB\ufffd\ufffd\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cedfa3d8a54ff96033d4ad9f1f44e05f1307c7c9",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd@^ui\ufffd;\ufffd\u0003n\ufffd\ufffd\ufffd\ufffdXx\u001b+\ufffd\ufffd\t\ufffd\ufffd\u0016\u001e\u0014Fr q\ufffd]\u0016\u000b\ufffd\ufffd#\ufffd\u000e\ufffd\u0001\u0441\ufffdd\ufffd\ufffd\ufffd-\ufffd\u07d7\ufffd\ufffdLB\ufffd\ufffd\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd@^ui\ufffd;\ufffdn\ufffd\ufffd\ufffd\ufffdXx+\ufffd\ufffd\t\ufffd\ufffdFr q\ufffd]\ufffd\ufffd#\ufffd\ufffd\u0441\ufffdd\ufffd\ufffd\ufffd-\ufffd\u07d7\ufffd\ufffdLB\ufffd\ufffd\ufffd:\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdu\ufffd",
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0001\ufffd\ufffd@^ui\ufffd;\ufffd\u0003n\ufffd\ufffd\ufffd\ufffdXx\u001b+\ufffd\ufffd\t\ufffd\ufffd\u0016\u001e\u0014Fr q\ufffd]\u0016\u000b\ufffd\ufffd#\ufffd\u000e\ufffd\u0001\u0441\ufffdd\ufffd\ufffd\ufffd-\ufffd\u07d7\ufffd\ufffdLB\ufffd\ufffd\ufffd:\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "postgres probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd@^ui\ufffd;\ufffdn\ufffd\ufffd\ufffd\ufffdXx+\ufffd\ufffd\t\ufffd\ufffdFr q\ufffd]\ufffd\ufffd#\ufffd\ufffd\u0441\ufffdd\ufffd\ufffd\ufffd-\ufffd\u07d7\ufffd\ufffdLB\ufffd\ufffd\ufffd:\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdu\ufffd",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
88 · KERBEROS
|
kerberos
|
Sonde Kerberos
kerberos · via KERBEROS:88 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KERBEROS
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
88
Chemin / cible
—
Pourquoi cette classification : Type « kerberos » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "6e82000c0a104142434445464748494a",
"emulator_response_len": 16,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "kerberos",
"app_proto": "kerberos",
"asn": 208137,
"country": "DE",
"dst_port": 88,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "fe65256267055ff3741cb3e41e97d623e066dba9",
"event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "kerberos",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6"
},
"target_context": {
"dst_port": 88,
"service": "kerberos",
"service_name": "kerberos",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ebeb7af8f30f380ff10b2e6fd901d56429d2e157",
"protocol_details": {
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "kerberos",
"service_label_fr": "KERBEROS",
"dst_port": 88,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kerberos",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 88,
"service": "kerberos",
"service_label_fr": "KERBEROS"
},
"attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "88 \u00b7 KERBEROS",
"emulator_service": "kerberos",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kerberos",
"service_banner": "honeypot-kerberos",
"service_os": "linux",
"dst_port": "88"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
81 · HTTP ALT 81
|
http-alt-81
|
Sonde PostgreSQL
postgres probe · via HTTP ALT 81:81 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-81
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
81
Chemin / cible
—
Service
HTTP ALT 81
Payload
� �Ub(�Lq;�� ��[���u �%Ӷ����U� ��fB�I����5�����4�x����9= �+�/�,�0̨̩� �� � u �
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
57%
Corrélation +8
Risque capteur
Faible
· 35
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0369
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Ub(�Lq;�� ��[���u �%Ӷ����U� ��fB�I����5�����4�x����9= �+�/�,�0̨̩� ��
� u �
Requête brute (extrait)
� �Ub(�Lq;�� ��[���u �%Ӷ����U� ��fB�I����5�����4�x����9= �+�/�,�0̨̩� �� � u � ��� 2 h2http/1.1 + 3�����Z-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 1505,
"payload_entropy": 7.738557312322711,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http-alt-81",
"app_proto": "http-alt-81",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "78af023cf79e2cc551b3bc717eee4762bcf624d5",
"event_fingerprint": "da8b22a909c287a6570bb2c7dce20fa4de2070cb",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.57,
"classification_confidence": 0.57,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http-alt-81",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e89bb7ba22da092476aa95dbbe9075cf",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 81,
"service": "http-alt-81",
"service_name": "http-alt-81",
"risk_score": 35
},
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Ub\u0015(\ufffdLq;\ufffd\ufffd\u000b\ufffd\ufffd[\ufffd\u0002\ufffd\ufffdu\u001d\ufffd%\u04f6\ufffd\ufffd\ufffd\ufffdU\u0015\ufffd\u0011 \ufffd\ufffdfB\ufffdI\ufffd\ufffd\ufffd\ufffd\u0014\u00195\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\u0019\u00144\ufffdx\ufffd\ufffd\ufffd\u0003\ufffd9=\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Ub\u0015(\ufffdLq;\ufffd\ufffd\u000b\ufffd\ufffd[\ufffd\u0002\ufffd\ufffdu\u001d\ufffd%\u04f6\ufffd\ufffd\ufffd\ufffdU\u0015\ufffd\u0011 \ufffd\ufffdfB\ufffdI\ufffd\ufffd\ufffd\ufffd\u0014\u00195\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\u0019\u00144\ufffdx\ufffd\ufffd\ufffd\u0003\ufffd9=\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdZ-",
"payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Ub\u0015(\ufffdLq;\ufffd\ufffd\u000b\ufffd\ufffd[\ufffd\u0002\ufffd\ufffdu\u001d\ufffd%\u04f6\ufffd\ufffd\ufffd\ufffdU\u0015\ufffd\u0011 \ufffd\ufffdfB\ufffdI\ufffd\ufffd\ufffd\ufffd\u0014\u00195\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\u0019\u00144\ufffdx\ufffd\ufffd\ufffd\u0003\ufffd9=\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f42e365cb97eed5b618fa6f7d59f7b9e29732eb",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Ub\u0015(\ufffdLq;\ufffd\ufffd\u000b\ufffd\ufffd[\ufffd\u0002\ufffd\ufffdu\u001d\ufffd%\u04f6\ufffd\ufffd\ufffd\ufffdU\u0015\ufffd\u0011 \ufffd\ufffdfB\ufffdI\ufffd\ufffd\ufffd\ufffd\u0014\u00195\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\u0019\u00144\ufffdx\ufffd\ufffd\ufffd\u0003\ufffd9=\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 81,
"service": "http-alt-81",
"service_label_fr": "HTTP ALT 81"
},
"evidence_snippet": "\ufffd\ufffdUb(\ufffdLq;\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffdu\ufffd%\u04f6\ufffd\ufffd\ufffd\ufffdU\ufffd \ufffd\ufffdfB\ufffdI\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffdx\ufffd\ufffd\ufffd\ufffd9=\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdu\ufffd",
"attack_vector": "postgres probe \u00b7 via HTTP ALT 81:81 \u00b7 (sonde \/ probe)",
"target_port_label": "81 \u00b7 HTTP ALT 81",
"emulator_service": "http-alt-81",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
"confidence_pct": 57,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 35,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 35,
"risk_label": "Faible",
"service_name": "http-alt-81",
"service_label_fr": "HTTP ALT 81",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"pat-0369"
],
"tags_summary_labels_fr": [
"pat-0369"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-81",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Ub\u0015(\ufffdLq;\ufffd\ufffd\u000b\ufffd\ufffd[\ufffd\u0002\ufffd\ufffdu\u001d\ufffd%\u04f6\ufffd\ufffd\ufffd\ufffdU\u0015\ufffd\u0011 \ufffd\ufffdfB\ufffdI\ufffd\ufffd\ufffd\ufffd\u0014\u00195\ufffd\ufffd\ufffd\ufffd\ufffd\u0016\u0019\u00144\ufffdx\ufffd\ufffd\ufffd\u0003\ufffd9=\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005u\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
"port": 81,
"service": "http-alt-81",
"service_label_fr": "HTTP ALT 81"
},
"attack_vector": "postgres probe \u00b7 via HTTP ALT 81:81 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd\ufffdUb(\ufffdLq;\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffdu\ufffd%\u04f6\ufffd\ufffd\ufffd\ufffdU\ufffd \ufffd\ufffdfB\ufffdI\ufffd\ufffd\ufffd\ufffd5\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffdx\ufffd\ufffd\ufffd\ufffd9=\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdu\ufffd",
"target_port_label": "81 \u00b7 HTTP ALT 81",
"emulator_service": "http-alt-81",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_81",
"service_banner": "honeypot-http-alt-81",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_clienthello"
]
}
|
|
|
TCP |
81 · HTTP ALT 81
|
http-alt-81
|
Sonde HTTP 81
http-alt-81 · via HTTP ALT 81:81 · (sonde / probe)
|
Faible
|
Faible · 0
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-81
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
81
Chemin / cible
—
Pourquoi cette classification : Type « http-alt-81 » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http-alt-81",
"app_proto": "http-alt-81",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "3f22551d39a092b08990354bd45c12679c434288",
"event_fingerprint": "da8b22a909c287a6570bb2c7dce20fa4de2070cb",
"classification_reason": "Type \u00ab http-alt-81 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http-alt-81",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "96b5770472eb71fcb1b2ba3134979c11"
},
"target_context": {
"dst_port": 81,
"service": "http-alt-81",
"service_name": "http-alt-81",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "69194244bb15d2200512453f1473c859a5919b2d",
"protocol_details": {
"port": 81,
"service": "http-alt-81",
"service_label_fr": "HTTP ALT 81"
},
"attack_vector": "http-alt-81 \u00b7 via HTTP ALT 81:81 \u00b7 (sonde \/ probe)",
"target_port_label": "81 \u00b7 HTTP ALT 81",
"emulator_service": "http-alt-81",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-81 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab http-alt-81 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "http-alt-81",
"service_label_fr": "HTTP ALT 81",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-81",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 81,
"service": "http-alt-81",
"service_label_fr": "HTTP ALT 81"
},
"attack_vector": "http-alt-81 \u00b7 via HTTP ALT 81:81 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "81 \u00b7 HTTP ALT 81",
"emulator_service": "http-alt-81",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_81",
"service_banner": "honeypot-http-alt-81",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
81 · HTTP ALT 81
|
http-alt-81
|
Botnet Mozi
mozi pattern · via HTTP ALT 81:81 · (commande & contrôle)
|
Élevée
|
Faible · 37
|
|
Étape
Commande & contrôle
Chaîne
Commande & contrôle
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0011
TA0011
Protocole
Émulateur
HTTP-ALT-81
WAF
—
Recommandation
Surveiller
Tags
http_get_probe
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
81
Chemin / cible
—
Service
HTTP ALT 81
Payload
GET /staging/ HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHT
Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 37
Confiance : Confiance 0 % — 3 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0011
Tactiques MITRE
TA0011
User-Agent
—
Règles WAF
—
Payload (extrait)
GET /staging/ HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHT
Requête brute (extrait)
GET /staging/ HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 261,
"payload_entropy": 5.394241100318089,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http-alt-81",
"app_proto": "http-alt-81",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 8,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 40,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15
},
"risk_score": 37,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "878bf0a3a832bf5d15c6d451d6b84ad06806c9e4",
"event_fingerprint": "5245e7debf5f262a4f0b3cde82cca0f4235cd4d7",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 37,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http-alt-81",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dce2e723a34610bacccba0511a915759",
"path_pattern_hash": "762d384fab941f6d0c2239f19994f30e"
},
"target_context": {
"dst_port": 81,
"service": "http-alt-81",
"service_name": "http-alt-81",
"risk_score": 37
},
"payload_preview": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"request_sample": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: ",
"payload_snippet": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"evidence": {
"request_sample": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: ",
"payload_snippet": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "c2",
"mitre_tactics": [
"TA0011"
],
"mitre": "TA0011",
"threat_family": [
"botnet"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "99b29c4c2d1ea87f94e4533894df4ea434f7fce2",
"protocol_details": {
"payload_preview": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"port": 81,
"service": "http-alt-81",
"service_label_fr": "HTTP ALT 81"
},
"evidence_snippet": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"attack_vector": "mozi pattern \u00b7 via HTTP ALT 81:81 \u00b7 (commande & contr\u00f4le)",
"target_port_label": "81 \u00b7 HTTP ALT 81",
"emulator_service": "http-alt-81",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 37\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 8 % \u2014 via HTTP ALT 81 \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 40,
"novelty": 15,
"risk_score": 37,
"correlation_boost": 8
},
"attack_stage": "c2",
"attack_stage_label": "Commande & contr\u00f4le",
"attack_chain_stage": "command_and_control",
"attack_chain_stage_label_fr": "Commande & contr\u00f4le",
"risk_score": 37,
"risk_label": "Faible",
"service_name": "http-alt-81",
"service_label_fr": "HTTP ALT 81",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0011",
"mitre_technique": "TA0011",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-81",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"payload_preview": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"port": 81,
"service": "http-alt-81",
"service_label_fr": "HTTP ALT 81"
},
"attack_vector": "mozi pattern \u00b7 via HTTP ALT 81:81 \u00b7 (commande & contr\u00f4le)",
"evidence_snippet": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"target_port_label": "81 \u00b7 HTTP ALT 81",
"emulator_service": "http-alt-81",
"confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "stage"
},
{
"key": "command_and_control",
"label_fr": "Commande & contr\u00f4le",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_81",
"service_banner": "honeypot-http-alt-81",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "command_and_control",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_get_probe",
"mozi_pattern",
"net_mozi_pattern"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /temp/
|
Élevée
|
Moyen · 51
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /temp/ UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/temp/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/temp/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 51
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /temp/ HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /temp/ HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML,
Requête brute (extrait)
GET /temp/ HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests: 1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "4a1b08b1f6d15bc48eb4d5f1efce79d6359fc771",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 258,
"payload_entropy": 5.407871254586384,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "adab595e4331d7bec6b986c47697fca4df234d1c",
"event_fingerprint": "f82cee4d71e4c726f7efefe1581ed7181a02b66e",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "662321a62a763bddd2510e5f8b278ca3",
"path_pattern_hash": "edd85d6439d406761e82c4ddc55b2f48"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"method": "GET",
"path": "\/temp\/",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/temp\/ HTTP\/1.1",
"request_sample": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\n",
"payload_snippet": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/temp\/",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/temp\/ HTTP\/1.1",
"request_sample": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\n",
"payload_snippet": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50097fcd7e0f520c2bf4191f6d202eddb9af0996",
"protocol_details": {
"http_method": "GET",
"http_path": "\/temp\/",
"request_line": "GET \/temp\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/temp\/",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/temp\/",
"request_line": "GET \/temp\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/temp\/",
"evidence_snippet": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde de test
probe test · via HTTP:81 · (sonde / probe) · → /test/
|
Élevée
|
Moyen · 47
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /test/ UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
19
Recommandation
Surveiller
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_test
Cible HTTP
GET
/test/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/test/
Pourquoi cette classification : Type « probe_test » (signaux protocolaires) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 47
Confiance : Confiance 50 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /test/ HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /test/ HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML,
Requête brute (extrait)
GET /test/ HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests: 1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "5411388e827eca295edece717228823dd2fe055c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 258,
"payload_entropy": 5.388891556790209,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 84,
"risk_classification": 54,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 84,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 47,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "77f2698adb573d78b43ee62d74f21e6a74637c11",
"event_fingerprint": "af786c67dfe6e35e440b956a53b6e1020eaf8bd3",
"classification_reason": "Type \u00ab probe_test \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "0501474e9425047bee06ecd96c5981ef",
"path_pattern_hash": "993b890b4d3e33c4356bbad8315b48e6"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"method": "GET",
"path": "\/test\/",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/test\/ HTTP\/1.1",
"request_sample": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\n",
"payload_snippet": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/test\/",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/test\/ HTTP\/1.1",
"request_sample": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\n",
"payload_snippet": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"classification_reason": "Type \u00ab probe_test \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "97aaa22c322e27a4e5b719da02ff05acd9e3bf2e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/test\/",
"request_line": "GET \/test\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"attack_vector": "probe test \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/test\/",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab probe_test \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab probe_test \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 84,
"classification": 54,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 47,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/test\/",
"request_line": "GET \/test\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "probe test \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/test\/",
"evidence_snippet": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_test",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /tests/
|
Élevée
|
Moyen · 51
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /tests/ UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/tests/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/tests/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 51
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /tests/ HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /tests/ HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML
Requête brute (extrait)
GET /tests/ HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests: 1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "cfdb712503e8f204172ad4fa3f50dba6b9d32d9c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.387109695947924,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "adab595e4331d7bec6b986c47697fca4df234d1c",
"event_fingerprint": "333684de1bb9abc04c980ef58414368a87ed3bca",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "22000cbb059a7b8aec025bbada24398b",
"path_pattern_hash": "85d97d07b983e825194afd944f439822"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"method": "GET",
"path": "\/tests\/",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/tests\/ HTTP\/1.1",
"request_sample": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r",
"payload_snippet": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"evidence": {
"method": "GET",
"path": "\/tests\/",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/tests\/ HTTP\/1.1",
"request_sample": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r",
"payload_snippet": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d0e4a492c1ebfc67a27f3cf5dd5818dab7f41284",
"protocol_details": {
"http_method": "GET",
"http_path": "\/tests\/",
"request_line": "GET \/tests\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tests\/",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/tests\/",
"request_line": "GET \/tests\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tests\/",
"evidence_snippet": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /tmp/
|
Élevée
|
Moyen · 51
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /tmp/ UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/tmp/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/tmp/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 51
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /tmp/ HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /tmp/ HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML,
Requête brute (extrait)
GET /tmp/ HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests: 1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "251e76217e69e2990a4d7c2ff22e87b96d67bd65",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 257,
"payload_entropy": 5.4149746718232805,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "adab595e4331d7bec6b986c47697fca4df234d1c",
"event_fingerprint": "f656390432b9c57cf938d839d7176bbf3479a685",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "c3420189db97513b15a62a7935008ca1",
"path_pattern_hash": "ac351c7174c8f47a9a9056bd96bcd71c"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, ",
"method": "GET",
"path": "\/tmp\/",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/tmp\/ HTTP\/1.1",
"request_sample": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\n\r",
"payload_snippet": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/tmp\/",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/tmp\/ HTTP\/1.1",
"request_sample": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\n\r",
"payload_snippet": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5eac85551421239227402d37d385e3265cabb5be",
"protocol_details": {
"http_method": "GET",
"http_path": "\/tmp\/",
"request_line": "GET \/tmp\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tmp\/",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/tmp\/",
"request_line": "GET \/tmp\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tmp\/",
"evidence_snippet": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML,",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Fuite / backup
backup file scan · via HTTP:81 · (tentative d'exploit) · → /yarn.lock
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /yarn.lock UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950517:leak-4
http_probe_yarn
Cible HTTP
GET
/yarn.lock
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/yarn.lock
Pourquoi cette classification : Règle WAF « leak-4 » · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 50 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /yarn.lock HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-4
Payload (extrait)
GET /yarn.lock HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KH
Requête brute (extrait)
GET /yarn.lock HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "lock",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "44a67014f3b33e0afca212fb73d5ee627ed558c7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.412718515796025,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 92,
"risk_classification": 70,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 92,
"classification": 70,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 54,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "98874078e2abe88d3ef1b8bb34a1dd25b6a67054",
"event_fingerprint": "ac00f74a9b4f033b1d0b6debf1411a578dcb1bd2",
"classification_reason": "R\u00e8gle WAF \u00ab leak-4 \u00bb \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 92,
"classification": 70,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "2f79c779bfc5e3424a1a7d662e934d75",
"path_pattern_hash": "2c3e7cd1d9a6e7f89c357fd517d36e2a"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"method": "GET",
"path": "\/yarn.lock",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950517:leak-4"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-4"
],
"request_line": "GET \/yarn.lock HTTP\/1.1",
"request_sample": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"evidence": {
"method": "GET",
"path": "\/yarn.lock",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950517:leak-4"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-4"
],
"request_line": "GET \/yarn.lock HTTP\/1.1",
"request_sample": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"classification_reason": "R\u00e8gle WAF \u00ab leak-4 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35e23ec7b8314977ff0b5c5091eb4950451ab617",
"protocol_details": {
"http_method": "GET",
"http_path": "\/yarn.lock",
"request_line": "GET \/yarn.lock HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"attack_vector": "backup file scan \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/yarn.lock",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab leak-4 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab leak-4 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 92,
"classification": 70,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/yarn.lock",
"request_line": "GET \/yarn.lock HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "backup file scan \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/yarn.lock",
"evidence_snippet": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950517:leak-4",
"http_probe_yarn",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /database.sql
|
Élevée
|
Moyen · 44
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /database.sql UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_backup_file_scan
http_backup_path
Cible HTTP
GET
/database.sql
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/database.sql
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · Sonde fichier sensible / config · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 44
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /database.sql HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /database.sql HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12
Requête brute (extrait)
GET /database.sql HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Reques
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "sql",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "a256b81a49571be3bda096f7ff40f264f6f65ea6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.401037825242844,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 44,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7918d40519975ec8dfb7a4c961fe5cd1090bead7",
"event_fingerprint": "0b52b2e54ae133e91fb13a6246a80dc7b40daf35",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "6a0a04702f8a1b288c01c1f8d864b170",
"path_pattern_hash": "5a42560e1122aec9e65ed81031f076c0"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 44
},
"payload_preview": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 ",
"method": "GET",
"path": "\/database.sql",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/database.sql HTTP\/1.1",
"request_sample": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"evidence": {
"method": "GET",
"path": "\/database.sql",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/database.sql HTTP\/1.1",
"request_sample": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f6b9cac38279ef37a397c4a4ccca99156b98a44",
"protocol_details": {
"http_method": "GET",
"http_path": "\/database.sql",
"request_line": "GET \/database.sql HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/database.sql",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 44,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/database.sql",
"request_line": "GET \/database.sql HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/database.sql",
"evidence_snippet": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_backup_file_scan",
"http_backup_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:81 · (tentative d'exploit) · → /credentials.json
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /credentials.json UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/credentials.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /credentials.json HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416
Requête brute (extrait)
GET /credentials.json HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Re
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "52ce12cd9608e2aaf265869963eb9ccc97689fda",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 269,
"payload_entropy": 5.395238551410996,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "ec52efa4514539126f3e024a4ba63caf96008290",
"event_fingerprint": "6ce199faad996ca941f1f576b6f3e945a7f2cd53",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "7693da5f13331a25d642435593474a16",
"path_pattern_hash": "2c897236c88b33a0e02927235471c8c3"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"method": "GET",
"path": "\/credentials.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/credentials.json HTTP\/1.1",
"request_sample": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Re",
"payload_snippet": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"evidence": {
"method": "GET",
"path": "\/credentials.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/credentials.json HTTP\/1.1",
"request_sample": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Re",
"payload_snippet": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d9615efa8ec51f48603d1f2d25d39580bba564e9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/credentials.json",
"request_line": "GET \/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"attack_vector": "credential file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.json",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/credentials.json",
"request_line": "GET \/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.json",
"evidence_snippet": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /config/.env.php
|
Élevée
|
Moyen · 63
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /config/.env.php UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/config/.env.php
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/config/.env.php
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/.env.php HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /config/.env.php HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.
Requête brute (extrait)
GET /config/.env.php HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Req
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "54bc453b60497c1fe609887d2d09e4d6b3efcd4e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 268,
"payload_entropy": 5.404542883878726,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "63da83ab3610945bf84adf5b2ad7cb36dc124074",
"event_fingerprint": "78a07ff414e191d70d59e952f3c9a40b6da09a04",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "bb3c026bd34e981e89a573030887c5f1",
"path_pattern_hash": "9033e65212bec8044da5132f26107c7c"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"method": "GET",
"path": "\/config\/.env.php",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env.php HTTP\/1.1",
"request_sample": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Req",
"payload_snippet": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"evidence": {
"method": "GET",
"path": "\/config\/.env.php",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/config\/.env.php HTTP\/1.1",
"request_sample": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Req",
"payload_snippet": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d211bc80d54114732b45395b55c4646bf810a47",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/.env.php",
"request_line": "GET \/config\/.env.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/.env.php",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/.env.php",
"request_line": "GET \/config\/.env.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/.env.php",
"evidence_snippet": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_config",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /config.json
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /config.json UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_sensitive_path
net_web_probe
Cible HTTP
GET
/config.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 49
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
pat-0247
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /config.json
Ligne de requête
GET /config.json HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config.json HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (
Requête brute (extrait)
GET /config.json HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Request
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "110dc2bb220538a9df6ea13fd8474a5056c773dc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.412573205945316,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 49,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a7f37617d3b15a9d47a24a5ff390ba4316bfa479",
"event_fingerprint": "50845d45fec405ae09e896efe4f342c4bc4a22c9",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 182,
"precision_signals": [
"INT-http_sensitive",
"pat-0247",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"pat-0247",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0247"
],
"matched_pattern_names": [
"Probe \/config.json"
],
"pattern_ids": [
"pat-0247"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "94eb3154baa434a785817f396584f00e",
"path_pattern_hash": "b2ebf86a95e6e198c8d34ea73388c4ce"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"method": "GET",
"path": "\/config.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.json HTTP\/1.1",
"request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Request",
"payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"evidence": {
"method": "GET",
"path": "\/config.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config.json HTTP\/1.1",
"request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Request",
"payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f830fbb9fa1f1926af53a744866af7d962f1fbc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.json",
"request_line": "GET \/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"pat-0247",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"pat-0247",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config.json",
"request_line": "GET \/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json",
"evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /application.yml
|
Élevée
|
Moyen · 42
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /application.yml UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/application.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/application.yml
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /application.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /application.yml HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.
Requête brute (extrait)
GET /application.yml HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Req
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "b5819b2c14e2e66f80448b9cafafa1033e7b1cec",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 268,
"payload_entropy": 5.414434753273347,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b3a317da9ab8844e5cc5b07a1bbfc707faf1a9bf",
"event_fingerprint": "f9b8e30d75aedec11b68396c0efcb1329066e17d",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "0b6040de6d6198d62c91c61c3970e484",
"path_pattern_hash": "18101755b44cc6d8b270134bcce32edf"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"method": "GET",
"path": "\/application.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application.yml HTTP\/1.1",
"request_sample": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Req",
"payload_snippet": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"evidence": {
"method": "GET",
"path": "\/application.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application.yml HTTP\/1.1",
"request_sample": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Req",
"payload_snippet": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9829a6c64e20bbad1f0d943211dec1f96fdc3ca2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/application.yml",
"request_line": "GET \/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application.yml",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/application.yml",
"request_line": "GET \/application.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application.yml",
"evidence_snippet": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /application.properties
|
Élevée
|
Moyen · 42
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /application.properties UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/application.properties
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/application.properties
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /application.properties HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /application.properties HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebK
Requête brute (extrait)
GET /application.properties HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insec
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "properties",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "e3fd46d86bb2ad69319106117f93875bff130862",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 275,
"payload_entropy": 5.364702580257525,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b03831bfc0620be5cb9a92510f867cd7f016397f",
"event_fingerprint": "0682c4f8353eca43df60e1ddda01b1f648607254",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "d519af7508d0a91176f6211653954758",
"path_pattern_hash": "8c4feac6bcb94afde681db33f96763e3"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebK",
"method": "GET",
"path": "\/application.properties",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application.properties HTTP\/1.1",
"request_sample": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insec",
"payload_snippet": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebK",
"evidence": {
"method": "GET",
"path": "\/application.properties",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/application.properties HTTP\/1.1",
"request_sample": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insec",
"payload_snippet": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebK",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c438c7772f424e22835663e33232f47e7467099a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/application.properties",
"request_line": "GET \/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebK",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application.properties",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/application.properties",
"request_line": "GET \/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application.properties",
"evidence_snippet": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebK",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /app_dev.php/_profiler/.env
|
Élevée
|
Moyen · 63
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /app_dev.php/_profiler/.env UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950514:leak-1
Cible HTTP
GET
/app_dev.php/_profiler/.env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/app_dev.php/_profiler/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app_dev.php/_profiler/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /app_dev.php/_profiler/.env HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) Apple
Requête brute (extrait)
GET /app_dev.php/_profiler/.env HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-I
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "f075b3d401ab9d88b2d00d435895f8b01984fa60",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 279,
"payload_entropy": 5.424416536634282,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "3f95a31bbff007973171ce593e721df7d341fe55",
"event_fingerprint": "9e13b93a384588c48e0d8604094477317fb238bf",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "0a668e983ba0479a5a2875644a22c5f1",
"path_pattern_hash": "df2bb3033788be83642220993943c1fd"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) Apple",
"method": "GET",
"path": "\/app_dev.php\/_profiler\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1",
"request_sample": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-I",
"payload_snippet": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) Apple",
"evidence": {
"method": "GET",
"path": "\/app_dev.php\/_profiler\/.env",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1",
"request_sample": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-I",
"payload_snippet": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) Apple",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "074ab8e9dfd56233e6808eff212722e47e491560",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app_dev.php\/_profiler\/.env",
"request_line": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) Apple",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app_dev.php\/_profiler\/.env",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app_dev.php\/_profiler\/.env",
"request_line": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app_dev.php\/_profiler\/.env",
"evidence_snippet": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) Apple",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /app.log
|
Élevée
|
Moyen · 42
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /app.log UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/app.log
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/app.log
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app.log HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app.log HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTM
Requête brute (extrait)
GET /app.log HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests: 1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "log",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "bd1d5b79d00a082701f913befabe9ce3bb41a839",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 260,
"payload_entropy": 5.397962947758989,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f933fe32e897d935bf8c1ba2965b703e85caa709",
"event_fingerprint": "a170b6f0aaff4b399ee78616ab75e733a81f4b4f",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "780962b877b0e32909bf1896194dbd06",
"path_pattern_hash": "705676047b0602f87a6c259c895bc0e9"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTM",
"method": "GET",
"path": "\/app.log",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app.log HTTP\/1.1",
"request_sample": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1",
"payload_snippet": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTM",
"evidence": {
"method": "GET",
"path": "\/app.log",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app.log HTTP\/1.1",
"request_sample": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1",
"payload_snippet": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTM",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "34971408f5bbf01f5a61caa43e6fde61c94e971c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app.log",
"request_line": "GET \/app.log HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTM",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app.log",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app.log",
"request_line": "GET \/app.log HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app.log",
"evidence_snippet": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTM",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /.svn/entries
|
Élevée
|
Moyen · 63
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.svn/entries UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950519:leak-6
Cible HTTP
GET
/.svn/entries
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.svn/entries
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET .svn entries
Probe /.svn/entries
Ligne de requête
GET /.svn/entries HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-6
Payload (extrait)
GET /.svn/entries HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12
Requête brute (extrait)
GET /.svn/entries HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Reques
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "svn\/entries",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "fec28f2e1aabccf1f7e02d7f5d2dd9dd95703725",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.38334228984113,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "c6500fb9c3e23214f4b95c33485b844976f97cdb",
"event_fingerprint": "4a77a061a244206f373b76c8207a3c91b606f61e",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0750",
"pat-0201"
],
"matched_pattern_names": [
"ET .svn entries",
"Probe \/.svn\/entries"
],
"pattern_ids": [
"pat-0750",
"pat-0201"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "a4d6e8e1dde460cc7f934bf5995c6334",
"path_pattern_hash": "a8bfcf5717c2407f76d3bb4e6b62379c"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 ",
"method": "GET",
"path": "\/.svn\/entries",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950519:leak-6"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-6"
],
"request_line": "GET \/.svn\/entries HTTP\/1.1",
"request_sample": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"evidence": {
"method": "GET",
"path": "\/.svn\/entries",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950519:leak-6"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-6"
],
"request_line": "GET \/.svn\/entries HTTP\/1.1",
"request_sample": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e8747942dd273cb96537919d506733f0d8d23af",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.svn\/entries",
"request_line": "GET \/.svn\/entries HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.svn\/entries",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.svn\/entries",
"request_line": "GET \/.svn\/entries HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.svn\/entries",
"evidence_snippet": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950519:leak-6",
"http_probe_svn",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /.kube/config
|
Élevée
|
Moyen · 47
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /.kube/config UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
19
Recommandation
Surveiller
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/.kube/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.kube/config
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 29%
Confiance classification
36%
Corrélation +8
Risque capteur
Moyen
· 47
Confiance : Confiance 29 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET .kube/config
Probe /.kube/config
Ligne de requête
GET /.kube/config HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.kube/config HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12
Requête brute (extrait)
GET /.kube/config HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Reques
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "kube\/config",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "6de07e41ec0c05d5881cf1a65cdbd8753277f973",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.4083271154873565,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 47,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "adab595e4331d7bec6b986c47697fca4df234d1c",
"event_fingerprint": "df3ba118cdf833708b3723abd783b2e29270a7cb",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%",
"confidence": 0.36,
"classification_confidence": 0.36,
"precision_score": 35,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"matched_patterns": [
"pat-0593",
"pat-0203"
],
"matched_pattern_names": [
"ET .kube\/config",
"Probe \/.kube\/config"
],
"pattern_ids": [
"pat-0593",
"pat-0203"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 47,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 29,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "447df522f03065a8536efeee5502e3a1",
"path_pattern_hash": "7ef33d76bc8de32d08d882a9ac8291f3"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/.kube\/config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 ",
"method": "GET",
"path": "\/.kube\/config",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.kube\/config HTTP\/1.1",
"request_sample": "GET \/.kube\/config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/.kube\/config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"evidence": {
"method": "GET",
"path": "\/.kube\/config",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.kube\/config HTTP\/1.1",
"request_sample": "GET \/.kube\/config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/.kube\/config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a035688eaf0fed90703f6a6504697006bc8a55c3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.kube\/config",
"request_line": "GET \/.kube\/config HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.kube\/config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.kube\/config",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 29 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 36 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 36,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 47,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.kube\/config",
"request_line": "GET \/.kube\/config HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.kube\/config",
"evidence_snippet": "GET \/.kube\/config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 29 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 36 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Scan secrets (CI/CD / clés)
secret scan · via HTTP:81 · (tentative d'exploit) · → /.gitlab-ci.yml
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /.gitlab-ci.yml UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_sensitive_path
net_web_probe
Cible HTTP
GET
/.gitlab-ci.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.gitlab-ci.yml
Pourquoi cette classification : Sonde fichier sensible: secret CI/CD · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 50 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /.gitlab-ci.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.gitlab-ci.yml HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.1
Requête brute (extrait)
GET /.gitlab-ci.yml HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requ
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "438af05b92495206533fc223d46e511d40c32485",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 267,
"payload_entropy": 5.427772212723771,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9db167ab2e46a99c632f2554368a64efc9c74871",
"event_fingerprint": "4f8115577986c1901fbef4dfbfad9a141be4b57b",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"MITRE-T1190"
],
"classification_reason": "Sonde fichier sensible: secret CI\/CD \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "ed152dfd829709fb4383278710f69767",
"path_pattern_hash": "1c248e6546ed96558dfcda198b4e61ef"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/.gitlab-ci.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.1",
"method": "GET",
"path": "\/.gitlab-ci.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.gitlab-ci.yml HTTP\/1.1",
"request_sample": "GET \/.gitlab-ci.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requ",
"payload_snippet": "GET \/.gitlab-ci.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.1",
"evidence": {
"method": "GET",
"path": "\/.gitlab-ci.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.gitlab-ci.yml HTTP\/1.1",
"request_sample": "GET \/.gitlab-ci.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requ",
"payload_snippet": "GET \/.gitlab-ci.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.1",
"classification_reason": "Sonde fichier sensible: secret CI\/CD \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aac436d68f0d82906b377f7c9c6ff27001cb7e30",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.gitlab-ci.yml",
"request_line": "GET \/.gitlab-ci.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.gitlab-ci.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.1",
"attack_vector": "secret scan \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.gitlab-ci.yml",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: secret CI\/CD \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%",
"classification_reason_label_fr": "Sonde fichier sensible: secret CI\/CD \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.gitlab-ci.yml",
"request_line": "GET \/.gitlab-ci.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "secret scan \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.gitlab-ci.yml",
"evidence_snippet": "GET \/.gitlab-ci.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.1",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /.env.test
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.test UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.test
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.env.test
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.test HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.test HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KH
Requête brute (extrait)
GET /.env.test HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "test",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "4e40a92f813d5ab41a0033a3846a1a977ff1de23",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.383006673363602,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 60,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "ac3dbfd28611e5b0036b6ce0482b20b39c044264",
"event_fingerprint": "ba7b088e0f8954491acf6ebf592b7798a5f69bae",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "b76bf546c5d461d05e414a566a1f80b2",
"path_pattern_hash": "d0f775cf96d71b1d76da4d08e462f07a"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"method": "GET",
"path": "\/.env.test",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test HTTP\/1.1",
"request_sample": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"evidence": {
"method": "GET",
"path": "\/.env.test",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.test HTTP\/1.1",
"request_sample": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "674360423643dae273ccee753641c89d368e4bdd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test",
"request_line": "GET \/.env.test HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.test",
"request_line": "GET \/.env.test HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.test",
"evidence_snippet": "GET \/.env.test HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /.env.staging
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.staging UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.staging
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.env.staging
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.staging HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.staging HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12
Requête brute (extrait)
GET /.env.staging HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Reques
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "staging",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "b697ca05984d1bd61ac6a6cd96868703f3417431",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.388343865088949,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 60,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "ac3dbfd28611e5b0036b6ce0482b20b39c044264",
"event_fingerprint": "802ebe7fa97e112e46c7bee9654116d202502c8e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "e01c53745fbac17cf5c6b8b26ed178ad",
"path_pattern_hash": "273c68db2803cfd6e1d27200e5969039"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 ",
"method": "GET",
"path": "\/.env.staging",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.staging HTTP\/1.1",
"request_sample": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"evidence": {
"method": "GET",
"path": "\/.env.staging",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.staging HTTP\/1.1",
"request_sample": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75e4a5210239d8ca7d4588de01d379de63d92b12",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.staging",
"request_line": "GET \/.env.staging HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.staging",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.staging",
"request_line": "GET \/.env.staging HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.staging",
"evidence_snippet": "GET \/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /.env.php.bak
|
Élevée
|
Moyen · 63
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.php.bak UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/.env.php.bak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.env.php.bak
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933111
Probe /.env
Ligne de requête
GET /.env.php.bak HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /.env.php.bak HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12
Requête brute (extrait)
GET /.env.php.bak HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Reques
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "bak",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "dbe3f8669c6c164935ffa54a19596c44ae920d26",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.407710389475737,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "375a436657fabe987c4998737201733fb7c6587b",
"event_fingerprint": "44034b4a785a1ce6c910678fd226cdcf572cc73c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0160",
"pat-0191"
],
"matched_pattern_names": [
"CRS 933111",
"Probe \/.env"
],
"pattern_ids": [
"pat-0160",
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "db510d32aed0f60a150fabb0cfd2e900",
"path_pattern_hash": "10cb9d5fb364e27a4e4f86833ba1f7de"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/.env.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 ",
"method": "GET",
"path": "\/.env.php.bak",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.php.bak HTTP\/1.1",
"request_sample": "GET \/.env.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/.env.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"evidence": {
"method": "GET",
"path": "\/.env.php.bak",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.php.bak HTTP\/1.1",
"request_sample": "GET \/.env.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/.env.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "156a8f3ebcdf5cb939fa25c67610c4224e7d1bfe",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.php.bak",
"request_line": "GET \/.env.php.bak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.php.bak",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.php.bak",
"request_line": "GET \/.env.php.bak HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.php.bak",
"evidence_snippet": "GET \/.env.php.bak HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /.env.php
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.php UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.php
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.env.php
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.php HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.php HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHT
Requête brute (extrait)
GET /.env.php HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "php",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "5abb0484d214bfc1c12fcc6a51d9893be51bc741",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 261,
"payload_entropy": 5.401863555560454,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.5,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 60,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "4beded1a4d08a6c8a3648dca34df5203a9deeb0e",
"event_fingerprint": "eb093a83a3062c0659926510d1978f7023b4985d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "1928ceda9de285653e1ff76ed7cac861",
"path_pattern_hash": "1ccecca2c51b0f91f56f410e1473047a"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"method": "GET",
"path": "\/.env.php",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.php HTTP\/1.1",
"request_sample": "GET \/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: ",
"payload_snippet": "GET \/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"evidence": {
"method": "GET",
"path": "\/.env.php",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.php HTTP\/1.1",
"request_sample": "GET \/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: ",
"payload_snippet": "GET \/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9b1c4e3bcc35d2fe6755ac760007b0de0ebcbb83",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.php",
"request_line": "GET \/.env.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.php",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.php",
"request_line": "GET \/.env.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.php",
"evidence_snippet": "GET \/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_probe_env",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /.env.orig
|
Élevée
|
Moyen · 60
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.orig UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
http_backup_file_scan
Cible HTTP
GET
/.env.orig
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.env.orig
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 60
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.orig HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /.env.orig HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KH
Requête brute (extrait)
GET /.env.orig HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "orig",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "a5360e8b4c24130ce7b83ff2db501eac1df0996e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.397482703627779,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 92,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 60,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "ac3dbfd28611e5b0036b6ce0482b20b39c044264",
"event_fingerprint": "81dd90b4e205db1899909bb27a34409041a8b718",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "4c50c9aa5119b18c4770cb12a727dd86",
"path_pattern_hash": "74a5485724e3b49c70feec62176e92c9"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/.env.orig HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"method": "GET",
"path": "\/.env.orig",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.orig HTTP\/1.1",
"request_sample": "GET \/.env.orig HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/.env.orig HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"evidence": {
"method": "GET",
"path": "\/.env.orig",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/.env.orig HTTP\/1.1",
"request_sample": "GET \/.env.orig HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/.env.orig HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "180c2bf0bca897e2d3029a9cb758b82c309b657b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.orig",
"request_line": "GET \/.env.orig HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.orig HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.orig",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.orig",
"request_line": "GET \/.env.orig HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.orig",
"evidence_snippet": "GET \/.env.orig HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /google-services.json
|
Élevée
|
Moyen · 42
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /google-services.json UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/google-services.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/google-services.json
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /google-services.json HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /google-services.json HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit
Requête brute (extrait)
GET /google-services.json HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecur
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "48633a9252d700d28f8fc41d6f90f454489dc1b6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 273,
"payload_entropy": 5.39260188774019,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b03831bfc0620be5cb9a92510f867cd7f016397f",
"event_fingerprint": "ef484c4de8d179838a83af4cdb929e864efd3e53",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "4adb32b1e124946cf203a98c84c133d2",
"path_pattern_hash": "7c1b716d1bd982942f1b382eae6688a2"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/google-services.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit",
"method": "GET",
"path": "\/google-services.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/google-services.json HTTP\/1.1",
"request_sample": "GET \/google-services.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecur",
"payload_snippet": "GET \/google-services.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/google-services.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/google-services.json HTTP\/1.1",
"request_sample": "GET \/google-services.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecur",
"payload_snippet": "GET \/google-services.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3089a8e29def96bf5e4e1a17984d92b26f7e48ef",
"protocol_details": {
"http_method": "GET",
"http_path": "\/google-services.json",
"request_line": "GET \/google-services.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/google-services.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/google-services.json",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/google-services.json",
"request_line": "GET \/google-services.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/google-services.json",
"evidence_snippet": "GET \/google-services.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:81 · (tentative d'exploit) · → /error.log
|
Élevée
|
Moyen · 45
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /error.log UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/error.log
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/error.log
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 56%
Confiance classification
64%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 56 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0115
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Error log disclosure
Ligne de requête
GET /error.log HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /error.log HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KH
Requête brute (extrait)
GET /error.log HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "log",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "4bf2a42fc3c47a9cd3c9f83a2dcc96b460ea695c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.395888979513936,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f933fe32e897d935bf8c1ba2965b703e85caa709",
"event_fingerprint": "7cf598c952959a0096650074fda3269d185500b8",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 66,
"precision_signals": [
"pat-0115"
],
"kb_rule_ids": [
"pat-0115"
],
"matched_patterns": [
"pat-0115"
],
"matched_pattern_names": [
"LFI Error log disclosure"
],
"pattern_ids": [
"pat-0115"
],
"confidence_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "b5bd293baff764468667a430fc8afbda",
"path_pattern_hash": "377fe372f5c11075aea15748100afc0d"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/error.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"method": "GET",
"path": "\/error.log",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/error.log HTTP\/1.1",
"request_sample": "GET \/error.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/error.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"evidence": {
"method": "GET",
"path": "\/error.log",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/error.log HTTP\/1.1",
"request_sample": "GET \/error.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/error.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "416e21980e62b40c24feb52c0043a7812563cc0e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/error.log",
"request_line": "GET \/error.log HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/error.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/error.log",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"pat-0115"
],
"tags_summary_labels_fr": [
"pat-0115"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/error.log",
"request_line": "GET \/error.log HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/error.log",
"evidence_snippet": "GET \/error.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /docker-compose.yaml
|
Élevée
|
Moyen · 42
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /docker-compose.yaml UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/docker-compose.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/docker-compose.yaml
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /docker-compose.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /docker-compose.yaml HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/
Requête brute (extrait)
GET /docker-compose.yaml HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "3bbb8fd589a1c6561445293d25ec31c27a2956aa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 272,
"payload_entropy": 5.4251671961214445,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b03831bfc0620be5cb9a92510f867cd7f016397f",
"event_fingerprint": "6ad95fc3304a6a87c5755e5db49c32967d2e4ec6",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "62be0ddcb94cf69fa157298adc707ede",
"path_pattern_hash": "d91024f4d52a5546d3cddb98775be9d6"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/",
"method": "GET",
"path": "\/docker-compose.yaml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure",
"payload_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/docker-compose.yaml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"request_sample": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure",
"payload_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bb822cf1773cda200e70b1f51e5583869525e86f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yaml",
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.yaml",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/docker-compose.yaml",
"request_line": "GET \/docker-compose.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/docker-compose.yaml",
"evidence_snippet": "GET \/docker-compose.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:81 · (tentative d'exploit) · → /debug.log
|
Élevée
|
Moyen · 45
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /debug.log UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_sensitive_path
net_web_probe
Cible HTTP
GET
/debug.log
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/debug.log
Pourquoi cette classification : Sonde fichier sensible / config · confiance 56%
Confiance classification
64%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 56 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0110
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Debug log disclosure
Ligne de requête
GET /debug.log HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /debug.log HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KH
Requête brute (extrait)
GET /debug.log HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "log",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "77d9f648329aebdef206c4b1d63546db6147ce3b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.413027242856199,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e6371f12fad27db9056e387d17bdf90bc501a25d",
"event_fingerprint": "1c92bb9e3b193b95e37cd2e99e8d6457d4a55c07",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 66,
"precision_signals": [
"pat-0110"
],
"kb_rule_ids": [
"pat-0110"
],
"matched_patterns": [
"pat-0110"
],
"matched_pattern_names": [
"LFI Debug log disclosure"
],
"pattern_ids": [
"pat-0110"
],
"confidence_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "54c294e70330aacc6f6e0c4ad15a43bf",
"path_pattern_hash": "55839acef8bcadd99e7e1a1cdf75a15f"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"method": "GET",
"path": "\/debug.log",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/debug.log HTTP\/1.1",
"request_sample": "GET \/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"evidence": {
"method": "GET",
"path": "\/debug.log",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/debug.log HTTP\/1.1",
"request_sample": "GET \/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests:",
"payload_snippet": "GET \/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c55a9b1093793de651a6d3de04b07acb80bbd53f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/debug.log",
"request_line": "GET \/debug.log HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/debug.log",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"pat-0110"
],
"tags_summary_labels_fr": [
"pat-0110"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/debug.log",
"request_line": "GET \/debug.log HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/debug.log",
"evidence_snippet": "GET \/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KH",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Fuite / backup
backup file scan · via HTTP:81 · (tentative d'exploit) · → /db.sql
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1552
TA0001
TA0002
Protocole
GET /db.sql UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_backup_path
net_web_probe
Cible HTTP
GET
/db.sql
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/db.sql
Pourquoi cette classification : Sonde fichier sensible / config · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 95 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
Scan fichiers backup
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /db.sql HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /db.sql HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML
Requête brute (extrait)
GET /db.sql HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests: 1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "sql",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "7e2f8d30b2d799ead5e3e6dd113633a88adb6dcc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.420217024513803,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 70,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 60,
"classification": 70,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 46,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1a6dcfacf4d0ee30973fc1ed0474803e91bfc647",
"event_fingerprint": "3c885c2b2618e9e01a143bb1f37248f9d32347a4",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 80,
"precision_signals": [
"INT-SEC-backup-files"
],
"kb_rule_ids": [
"INT-SEC-backup-files"
],
"confidence_breakdown": {
"waf": 60,
"classification": 70,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "8c7a7c3b85ac915cfed85047457eb85c",
"path_pattern_hash": "c5effee3516c7896e500ab1ef7dbf14c"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/db.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"method": "GET",
"path": "\/db.sql",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/db.sql HTTP\/1.1",
"request_sample": "GET \/db.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r",
"payload_snippet": "GET \/db.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"evidence": {
"method": "GET",
"path": "\/db.sql",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/db.sql HTTP\/1.1",
"request_sample": "GET \/db.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r",
"payload_snippet": "GET \/db.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1552"
],
"mitre": "T1552",
"threat_family": [
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f507fe4f808fff371696a23941a8d162e5c4589",
"protocol_details": {
"http_method": "GET",
"http_path": "\/db.sql",
"request_line": "GET \/db.sql HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/db.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"attack_vector": "backup file scan \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/db.sql",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 95%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1552 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 70,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"INT-SEC-backup-files"
],
"tags_summary_labels_fr": [
"Scan fichiers backup"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1552",
"mitre_technique": "T1552",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/db.sql",
"request_line": "GET \/db.sql HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "backup file scan \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/db.sql",
"evidence_snippet": "GET \/db.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_backup_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /database.yml
|
Élevée
|
Moyen · 43
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /database.yml UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/database.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/database.yml
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 43
Confiance : Confiance 50 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /database.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /database.yml HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12
Requête brute (extrait)
GET /database.yml HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Reques
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "d9be78204b9f1f993ba727c25934a91ddb9f7e73",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.428525419639615,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 43,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b3a317da9ab8844e5cc5b07a1bbfc707faf1a9bf",
"event_fingerprint": "d61b215f92e2a15abb7685467248aaf7a56e6ec3",
"classification_confidence": 0.58,
"confidence": 0.58,
"precision_signals": [
"MITRE-T1190"
],
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 43,
"correlation_boost": 8
},
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "8c722e7463e50a345bbecac85484accd",
"path_pattern_hash": "e456118ffd1efe78c2d2e3dd8e291349"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 ",
"method": "GET",
"path": "\/database.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/database.yml HTTP\/1.1",
"request_sample": "GET \/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"evidence": {
"method": "GET",
"path": "\/database.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/database.yml HTTP\/1.1",
"request_sample": "GET \/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e2fa798d87292c8b2f9dd07259af144a8c3a3cf1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/database.yml",
"request_line": "GET \/database.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/database.yml",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 43,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/database.yml",
"request_line": "GET \/database.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/database.yml",
"evidence_snippet": "GET \/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /web.config
|
Élevée
|
Moyen · 49
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /web.config UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_sensitive_path
net_web_probe
Cible HTTP
GET
/web.config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/web.config
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 49
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI IIS web.config
Ligne de requête
GET /web.config HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /web.config HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (K
Requête brute (extrait)
GET /web.config HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "config",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "fb61e36fe9095535f127e3353d957f1c1310e8e9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 263,
"payload_entropy": 5.41912158405315,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 49,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "a7f37617d3b15a9d47a24a5ff390ba4316bfa479",
"event_fingerprint": "c61feb109f00585c514d2070f843a4586a525a13",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0120"
],
"matched_pattern_names": [
"LFI IIS web.config"
],
"pattern_ids": [
"pat-0120"
],
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "c85e3565f89e95c46c30d17860039936",
"path_pattern_hash": "0913647d7e838cdd727ceda37a671f37"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 49
},
"payload_preview": "GET \/web.config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"method": "GET",
"path": "\/web.config",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/web.config HTTP\/1.1",
"request_sample": "GET \/web.config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests",
"payload_snippet": "GET \/web.config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"evidence": {
"method": "GET",
"path": "\/web.config",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/web.config HTTP\/1.1",
"request_sample": "GET \/web.config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests",
"payload_snippet": "GET \/web.config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "681672d8c3db069eed9aae420926ea963585cb6c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/web.config",
"request_line": "GET \/web.config HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/web.config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web.config",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 49,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 49,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/web.config",
"request_line": "GET \/web.config HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web.config",
"evidence_snippet": "GET \/web.config HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /terraform.tfstate
|
Élevée
|
Moyen · 42
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /terraform.tfstate UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/terraform.tfstate
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/terraform.tfstate
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 62 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /terraform.tfstate HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /terraform.tfstate HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/41
Requête brute (extrait)
GET /terraform.tfstate HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-R
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "tfstate",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "baeffa95e40dcec721558e2c8524eaa2244715f0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 270,
"payload_entropy": 5.399936232428713,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b03831bfc0620be5cb9a92510f867cd7f016397f",
"event_fingerprint": "9baf8555c4c588a23c1fd3c640017a17ed489e96",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "1815abf0d1ab693f5762c32b4ad16d82",
"path_pattern_hash": "ebaf0256ce61b0ddbaeff437c8371be6"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/terraform.tfstate HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/41",
"method": "GET",
"path": "\/terraform.tfstate",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/terraform.tfstate HTTP\/1.1",
"request_sample": "GET \/terraform.tfstate HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-R",
"payload_snippet": "GET \/terraform.tfstate HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/41",
"evidence": {
"method": "GET",
"path": "\/terraform.tfstate",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/terraform.tfstate HTTP\/1.1",
"request_sample": "GET \/terraform.tfstate HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-R",
"payload_snippet": "GET \/terraform.tfstate HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/41",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "876301c4414158f230b364d64bc3d6241db17e2e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/terraform.tfstate",
"request_line": "GET \/terraform.tfstate HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/terraform.tfstate HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/41",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/terraform.tfstate",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/terraform.tfstate",
"request_line": "GET \/terraform.tfstate HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/terraform.tfstate",
"evidence_snippet": "GET \/terraform.tfstate HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/41",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:81 · (tentative d'exploit) · → /settings.py
|
Élevée
|
Moyen · 45
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /settings.py UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/settings.py
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/settings.py
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 56%
Confiance classification
64%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 56 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0112
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Django settings
Ligne de requête
GET /settings.py HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /settings.py HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (
Requête brute (extrait)
GET /settings.py HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Request
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "py",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "3d04c639f33f174cecedd8e2b5ee24fd5f889511",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.398886986216574,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b03831bfc0620be5cb9a92510f867cd7f016397f",
"event_fingerprint": "955f0a3937187ccde87b23a927308c156c7059a7",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 66,
"precision_signals": [
"pat-0112"
],
"kb_rule_ids": [
"pat-0112"
],
"matched_patterns": [
"pat-0112"
],
"matched_pattern_names": [
"LFI Django settings"
],
"pattern_ids": [
"pat-0112"
],
"confidence_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "435a251dca537ebb1c00add365b5a59e",
"path_pattern_hash": "11cbdc1d0934c26ecc216cf25354d01f"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"method": "GET",
"path": "\/settings.py",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.py HTTP\/1.1",
"request_sample": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Request",
"payload_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"evidence": {
"method": "GET",
"path": "\/settings.py",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/settings.py HTTP\/1.1",
"request_sample": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Request",
"payload_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d88f2fa223d67b5c16171618568875f234d7416c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.py",
"request_line": "GET \/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.py",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"pat-0112"
],
"tags_summary_labels_fr": [
"pat-0112"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/settings.py",
"request_line": "GET \/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/settings.py",
"evidence_snippet": "GET \/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /server.key
|
Élevée
|
Faible · 38
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /server.key UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/server.key
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/server.key
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 29%
Confiance classification
36%
Corrélation +8
Risque capteur
Faible
· 38
Confiance : Confiance 29 % — 2 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Server private key
Ligne de requête
GET /server.key HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server.key HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (K
Requête brute (extrait)
GET /server.key HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "key",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "cf1afbf8420628be2ea8315c59921f18b70510e8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 263,
"payload_entropy": 5.406153070011674,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 38,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b03831bfc0620be5cb9a92510f867cd7f016397f",
"event_fingerprint": "cc649633603e361b11665af03699d00a105ce6f5",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%",
"confidence": 0.36,
"classification_confidence": 0.36,
"precision_score": 35,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"matched_patterns": [
"pat-0499"
],
"matched_pattern_names": [
"Cred Server private key"
],
"pattern_ids": [
"pat-0499"
],
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 38,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 29,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "1da8e6545bb9f422f6d0e3681a6db58d",
"path_pattern_hash": "51ffc9c2865ea094d2e6b0576cde621f"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 38
},
"payload_preview": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"method": "GET",
"path": "\/server.key",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server.key HTTP\/1.1",
"request_sample": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests",
"payload_snippet": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"evidence": {
"method": "GET",
"path": "\/server.key",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server.key HTTP\/1.1",
"request_sample": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests",
"payload_snippet": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "25b7429ffe5631bfafcb99e458dff66c827df46c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server.key",
"request_line": "GET \/server.key HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server.key",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 29 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 29%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 36 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 36,
"confidence_breakdown": {
"waf": 60,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 38,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 38,
"risk_label": "Faible",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server.key",
"request_line": "GET \/server.key HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server.key",
"evidence_snippet": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 29 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 36 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:81 · (sonde / probe) · → /security.txt
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /security.txt UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/security.txt
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/security.txt
Pourquoi cette classification : Sonde HTTP (tag rce-0) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
Fichier security.txt
Single Port
Chemin bénin connu
Tag WAF SQLi (security.txt)
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /security.txt HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /security.txt HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12
Requête brute (extrait)
GET /security.txt HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Reques
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b20636861727365743d7574662d380d0a436f6e74656e742d4c656e6774683a2039350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a436f6e74616374",
"emulator_response_len": 216,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "35388aa39f105600011ad0e7ab2a90933c84d4f3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.4157261151232765,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 42,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "b03831bfc0620be5cb9a92510f867cd7f016397f",
"event_fingerprint": "cd49b1e23ed950ae46e4c98a9f7689390a768b02",
"classification_reason": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 122,
"precision_signals": [
"INT-benign-security-txt",
"INT-single-port",
"INT-benign-path-cap",
"INT-sqli-tag-only-security-txt"
],
"kb_rule_ids": [
"INT-benign-security-txt",
"INT-single-port",
"INT-benign-path-cap",
"INT-sqli-tag-only-security-txt"
],
"confidence_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "b8779ad1a432e0cd274ce7909890b1bf",
"path_pattern_hash": "46dad10a99f0d5a132ae4c1e64099a4b"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 42
},
"payload_preview": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 ",
"method": "GET",
"path": "\/security.txt",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/security.txt HTTP\/1.1",
"request_sample": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"evidence": {
"method": "GET",
"path": "\/security.txt",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/security.txt HTTP\/1.1",
"request_sample": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"classification_reason": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "648b28745abf3edde22d91a4cefddcb168506c93",
"protocol_details": {
"http_method": "GET",
"http_path": "\/security.txt",
"request_line": "GET \/security.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/security.txt",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%",
"classification_reason_label_fr": "Sonde HTTP (tag rce-0) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 60,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"INT-benign-security-txt",
"INT-single-port",
"INT-benign-path-cap",
"INT-sqli-tag-only-security-txt"
],
"tags_summary_labels_fr": [
"Fichier security.txt",
"Single Port",
"Chemin b\u00e9nin connu",
"Tag WAF SQLi (security.txt)"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/security.txt",
"request_line": "GET \/security.txt HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:81 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/security.txt",
"evidence_snippet": "GET \/security.txt HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:81 · (tentative d'exploit) · → /secrets.yml
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /secrets.yml UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
http_k8s_probe
net_web_probe
Cible HTTP
GET
/secrets.yml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/secrets.yml
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0497
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets YAML
Ligne de requête
GET /secrets.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /secrets.yml HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (
Requête brute (extrait)
GET /secrets.yml HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Request
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "e7274406f40c7a10480f2d85d43c70d3b9b7d566",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.4121071678174415,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "bdddf2baa8a2394f481c129106346232da7efe6a",
"event_fingerprint": "d3acaf6bfdf66010014e6cd0a045a38fa1b23e9a",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0497",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0497",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0497"
],
"matched_pattern_names": [
"Cred Secrets YAML"
],
"pattern_ids": [
"pat-0497"
],
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "0a702f441f4905b7e15e7b1a63ae0f08",
"path_pattern_hash": "246a47626a113b12058b21154a5a0dd6"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/secrets.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"method": "GET",
"path": "\/secrets.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.yml HTTP\/1.1",
"request_sample": "GET \/secrets.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Request",
"payload_snippet": "GET \/secrets.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"evidence": {
"method": "GET",
"path": "\/secrets.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.yml HTTP\/1.1",
"request_sample": "GET \/secrets.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Request",
"payload_snippet": "GET \/secrets.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "83f5a2b6dfd5f2aa9a2dc287d768abda0fe50a20",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.yml",
"request_line": "GET \/secrets.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"attack_vector": "credential file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.yml",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"pat-0497",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0497",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.yml",
"request_line": "GET \/secrets.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.yml",
"evidence_snippet": "GET \/secrets.yml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_k8s_probe",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:81 · (tentative d'exploit) · → /secrets.json
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /secrets.json UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
http_k8s_probe
net_web_probe
Cible HTTP
GET
/secrets.json
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/secrets.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0496
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets JSON file
Ligne de requête
GET /secrets.json HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /secrets.json HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12
Requête brute (extrait)
GET /secrets.json HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Reques
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "9906f032745691753325e07cb911e68c17846b5d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.390641934661713,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "bdddf2baa8a2394f481c129106346232da7efe6a",
"event_fingerprint": "be51dcc008e2923531044bf873f69d4738863a04",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0496"
],
"matched_pattern_names": [
"Cred Secrets JSON file"
],
"pattern_ids": [
"pat-0496"
],
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "3b892cf379fb6638e321294cc82e78ef",
"path_pattern_hash": "1abd330c58113f23df400bb25a78bd81"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 ",
"method": "GET",
"path": "\/secrets.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.json HTTP\/1.1",
"request_sample": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"evidence": {
"method": "GET",
"path": "\/secrets.json",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/secrets.json HTTP\/1.1",
"request_sample": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Reques",
"payload_snippet": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c671030df8d83457341ee85ceab0b483e43c386",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.json",
"request_line": "GET \/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"attack_vector": "credential file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.json",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0496",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/secrets.json",
"request_line": "GET \/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/secrets.json",
"evidence_snippet": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_k8s_probe",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:81 · (tentative d'exploit) · → /k8s/secrets.yaml
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /k8s/secrets.yaml UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_k8s_probe
Cible HTTP
GET
/k8s/secrets.yaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/k8s/secrets.yaml
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
70%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 62 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /k8s/secrets.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /k8s/secrets.yaml HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416
Requête brute (extrait)
GET /k8s/secrets.yaml HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Re
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yaml",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "2b1f9fcb0e458e03ecb59a778e784573bcf025ce",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 269,
"payload_entropy": 5.418337868034221,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 84,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "47c5591add517af2827b1edd7fd3d27b0f5d128e",
"event_fingerprint": "1c9e2d419a8c01869f7664b03dbfeed49b82a627",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.7,
"classification_confidence": 0.7,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 52,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "2929b971e423e6f413d3d3bde5844313",
"path_pattern_hash": "3e2cca0fd234715d366a6869e4aaf6ff"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"method": "GET",
"path": "\/k8s\/secrets.yaml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/k8s\/secrets.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Re",
"payload_snippet": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"evidence": {
"method": "GET",
"path": "\/k8s\/secrets.yaml",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/k8s\/secrets.yaml HTTP\/1.1",
"request_sample": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Re",
"payload_snippet": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7e63a761b96ce7103a8a7bd1ca42643114f61586",
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/secrets.yaml",
"request_line": "GET \/k8s\/secrets.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/k8s\/secrets.yaml",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 70,
"confidence_breakdown": {
"waf": 84,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 52,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/k8s\/secrets.yaml",
"request_line": "GET \/k8s\/secrets.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/k8s\/secrets.yaml",
"evidence_snippet": "GET \/k8s\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_k8s_probe",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:81 · (tentative d'exploit) · → /backup.sql
|
Élevée
|
Moyen · 45
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /backup.sql UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_backup_file_scan
http_backup_path
Cible HTTP
GET
/backup.sql
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/backup.sql
Pourquoi cette classification : Sonde fichier sensible / config · confiance 56%
Confiance classification
64%
Corrélation +8
Risque capteur
Moyen
· 45
Confiance : Confiance 56 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
pat-0131
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI SQL backup dump
Ligne de requête
GET /backup.sql HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backup.sql HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (K
Requête brute (extrait)
GET /backup.sql HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "sql",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "0778e66dc91685120fa0e5222b9737c65f736401",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 263,
"payload_entropy": 5.411947462844102,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 45,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7918d40519975ec8dfb7a4c961fe5cd1090bead7",
"event_fingerprint": "731ed16461d19353ea6e5a0d7f1b18f3bff1ca04",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 66,
"precision_signals": [
"pat-0131"
],
"kb_rule_ids": [
"pat-0131"
],
"matched_patterns": [
"pat-0131"
],
"matched_pattern_names": [
"LFI SQL backup dump"
],
"pattern_ids": [
"pat-0131"
],
"confidence_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 45,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "b4bfdf8700bd0978ccb4ceff1c94d04d",
"path_pattern_hash": "2456a7a22b603c556554665c5d0203f5"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/backup.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"method": "GET",
"path": "\/backup.sql",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backup.sql HTTP\/1.1",
"request_sample": "GET \/backup.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests",
"payload_snippet": "GET \/backup.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"evidence": {
"method": "GET",
"path": "\/backup.sql",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backup.sql HTTP\/1.1",
"request_sample": "GET \/backup.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests",
"payload_snippet": "GET \/backup.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "42db8fc5ac623fe85119dae1193617ab46920b9a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup.sql",
"request_line": "GET \/backup.sql HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backup.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup.sql",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 60,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 45,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"pat-0131"
],
"tags_summary_labels_fr": [
"pat-0131"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backup.sql",
"request_line": "GET \/backup.sql HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backup.sql",
"evidence_snippet": "GET \/backup.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (K",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_backup_file_scan",
"http_backup_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:81 · (tentative d'exploit) · → /storage/logs/laravel.log
|
Élevée
|
Moyen · 53
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /storage/logs/laravel.log UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_sensitive_path
Cible HTTP
GET
/storage/logs/laravel.log
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/storage/logs/laravel.log
Pourquoi cette classification : Sonde fichier sensible / config · confiance 56%
Confiance classification
64%
Corrélation +8
Risque capteur
Moyen
· 53
Confiance : Confiance 56 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
pat-0124
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Laravel log
Ligne de requête
GET /storage/logs/laravel.log HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /storage/logs/laravel.log HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWe
Requête brute (extrait)
GET /storage/logs/laravel.log HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Ins
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "log",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "8fec6092b6d50f048de7f5341eb923ae4a4ab6d3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 277,
"payload_entropy": 5.381594266179579,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 84,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 84,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 53,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d30140490c648dbbbd72034d66463a1f3375abbb",
"event_fingerprint": "c9529d9c7b9faf7d9aaac213bb08139ef52ad0d3",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 66,
"precision_signals": [
"pat-0124"
],
"kb_rule_ids": [
"pat-0124"
],
"matched_patterns": [
"pat-0124"
],
"matched_pattern_names": [
"LFI Laravel log"
],
"pattern_ids": [
"pat-0124"
],
"confidence_breakdown": {
"waf": 84,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 53,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "2c400352be08ae90e96ce4c02caea08f",
"path_pattern_hash": "6f29914bb94c22caf991d0657dba887c"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWe",
"method": "GET",
"path": "\/storage\/logs\/laravel.log",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/storage\/logs\/laravel.log HTTP\/1.1",
"request_sample": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Ins",
"payload_snippet": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWe",
"evidence": {
"method": "GET",
"path": "\/storage\/logs\/laravel.log",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/storage\/logs\/laravel.log HTTP\/1.1",
"request_sample": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Ins",
"payload_snippet": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWe",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1588dcbde0f93b7d5d842678ab318d4806253ea8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/storage\/logs\/laravel.log",
"request_line": "GET \/storage\/logs\/laravel.log HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWe",
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/storage\/logs\/laravel.log",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 84,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 53,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"pat-0124"
],
"tags_summary_labels_fr": [
"pat-0124"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/storage\/logs\/laravel.log",
"request_line": "GET \/storage\/logs\/laravel.log HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/storage\/logs\/laravel.log",
"evidence_snippet": "GET \/storage\/logs\/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWe",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Fuite / backup
backup file scan · via HTTP:81 · (tentative d'exploit) · → /dump.sql
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1552
TA0001
TA0002
Protocole
GET /dump.sql UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
13
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
http_backup_file_scan
http_backup_path
Cible HTTP
GET
/dump.sql
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/dump.sql
Pourquoi cette classification : Sonde fichier sensible / config · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 46
Confiance : Confiance 95 % — Motif catalogue confirmé · 2 tag(s) WAF
Protocole émulé
1
Signaux
Scan fichiers backup
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI SQL dump file
Ligne de requête
GET /dump.sql HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /dump.sql HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHT
Requête brute (extrait)
GET /dump.sql HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "sql",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "1fc830e90e8ffa94d6b83234ae2ec2ba7b5108ba",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 261,
"payload_entropy": 5.42917616099036,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 60,
"risk_classification": 70,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 60,
"classification": 70,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7918d40519975ec8dfb7a4c961fe5cd1090bead7",
"event_fingerprint": "1d3ac0689bad71494165efed32b6a7c898d9e4a7",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 80,
"precision_signals": [
"INT-SEC-backup-files"
],
"kb_rule_ids": [
"INT-SEC-backup-files"
],
"matched_patterns": [
"pat-0132"
],
"matched_pattern_names": [
"LFI SQL dump file"
],
"pattern_ids": [
"pat-0132"
],
"confidence_breakdown": {
"waf": 60,
"classification": 70,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "22b0b52fe3f8c928830d4d7a07f9e99b",
"path_pattern_hash": "2debf0ced7dd0a1204edf7447a578b8e"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/dump.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"method": "GET",
"path": "\/dump.sql",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/dump.sql HTTP\/1.1",
"request_sample": "GET \/dump.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: ",
"payload_snippet": "GET \/dump.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"evidence": {
"method": "GET",
"path": "\/dump.sql",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/dump.sql HTTP\/1.1",
"request_sample": "GET \/dump.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: ",
"payload_snippet": "GET \/dump.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1552"
],
"mitre": "T1552",
"threat_family": [
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b0cae8d96a8bb178e7ba21cb3c64fa9b6fceac9b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/dump.sql",
"request_line": "GET \/dump.sql HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/dump.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"attack_vector": "backup file scan \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dump.sql",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 95%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1552 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 70,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"INT-SEC-backup-files"
],
"tags_summary_labels_fr": [
"Scan fichiers backup"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1552",
"mitre_technique": "T1552",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/dump.sql",
"request_line": "GET \/dump.sql HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "backup file scan \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dump.sql",
"evidence_snippet": "GET \/dump.sql HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"http_backup_file_scan",
"http_backup_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:81 · (tentative d'exploit) · → /.env.old
|
Élevée
|
Moyen · 64
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.env.old UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950514:leak-1
950521:leak-8
Cible HTTP
GET
/.env.old
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.env.old
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-config-leak
Http Sensitive
pat-0191
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Probe /.env
Ligne de requête
GET /.env.old HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
leak-1
leak-8
Payload (extrait)
GET /.env.old HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHT
Requête brute (extrait)
GET /.env.old HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Requests:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "old",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "5c6d2af3e13d17105c8f5fb6187fb5c332303b42",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 261,
"payload_entropy": 5.403581490486533,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 64,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "df9639d6c8e378654f20e930ea2d9e85a1c28f4b",
"event_fingerprint": "90df8f3e479f3c8500c40ab2d0e736590a83bcf0",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 270,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0191"
],
"matched_pattern_names": [
"Probe \/.env"
],
"pattern_ids": [
"pat-0191"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "1586dd18ed2e5aca5379160edb3b0af8",
"path_pattern_hash": "3807eb1255fb0315f3ffbb94c31e25e0"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"method": "GET",
"path": "\/.env.old",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.old HTTP\/1.1",
"request_sample": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: ",
"payload_snippet": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"evidence": {
"method": "GET",
"path": "\/.env.old",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"leak-1",
"leak-8"
],
"request_line": "GET \/.env.old HTTP\/1.1",
"request_sample": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: ",
"payload_snippet": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fffad9eccdf0801c0a3469a72481748c5d961df0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.old",
"request_line": "GET \/.env.old HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.old",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"pat-0191",
"INT-upstream"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"pat-0191",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.env.old",
"request_line": "GET \/.env.old HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.old",
"evidence_snippet": "GET \/.env.old HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHT",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"http_backup_file_scan",
"http_backup_path",
"http_probe_env",
"http_sensitive_path",
"net_web_probe"
]
}
|
|
|
TCP |
81 · HTTP
|
http
|
Sonde fichier credential / clé
credential file probe · via HTTP:81 · (tentative d'exploit) · → /.aws/credentials
|
Élevée
|
Moyen · 58
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.aws/credentials UA Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/.aws/credentials
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
81
Chemin / cible
/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 58
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1
Signaux
SIGMA-web-credential-file
pat-0468
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
Ligne de requête
GET /.aws/credentials HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /.aws/credentials HTTP/1.1
Host: 62.3.50.33:81
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416
Requête brute (extrait)
GET /.aws/credentials HTTP/1.1 Host: 62.3.50.33:81 User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-Insecure-Re
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "872518798628a64019cf0d525fe9b8ccadeaec3b",
"http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
"http_target_hash": "ace4c5fcde31b7bd909f97bc14a4a98472286e7e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 269,
"payload_entropy": 5.3957267869035865,
"port_category": "well_known",
"org": "Feo Prest SRL",
"service": "http",
"app_proto": "http",
"asn": 208137,
"country": "DE",
"dst_port": 81,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "6bf3aae62adbd7b2bed36d7787691ef3d5574209",
"event_fingerprint": "9874df50bb098e698564b7aff2d226c9dc7aa273",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 225,
"precision_signals": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0468"
],
"matched_pattern_names": [
"Cred AWS credentials file"
],
"pattern_ids": [
"pat-0468"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 58,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 208137,
"org": "Feo Prest SRL",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "857b65054b577999fdc0d9003a0af065",
"payload_hash": "b264ff42e436d0d6fa87c1cb1ad9f67f",
"path_pattern_hash": "02b5f84eeada8b8c7cddae6a529f493a"
},
"target_context": {
"dst_port": 81,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"method": "GET",
"path": "\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Re",
"payload_snippet": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"evidence": {
"method": "GET",
"path": "\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13\r\nAccept: *\/*\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-Insecure-Re",
"payload_snippet": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5b70933911e3c73402a8d370bbd98f3628f0a3a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.aws\/credentials",
"request_line": "GET \/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"attack_vector": "credential file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.aws\/credentials",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 58,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 81,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-credential-file",
"pat-0468",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.aws\/credentials",
"request_line": "GET \/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416.12 (KHTML, like Gecko) Safari\/416.13",
"port": 81,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:81 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.aws\/credentials",
"evidence_snippet": "GET \/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit\/416",
"target_port_label": "81 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "81"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-81"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
]
}
|