Fiche IP

Allemagne

213.209.159.175

Activité suspecte · risque 35/100

FAI Feo Prest SRL Première vue 12/10/2026 22:06 UTC Dernière vue 13/10/2026 06:37 UTC Risque Élevé

Période 2026-09-13 → 2026-10-13

Élevé 65/100

24h 7j 30j 90j

Synthèse

Score de risque max. 65/100 Élevé · Maximum de risk_score (événements honeypot)

Première observation 12/10/2026 22:06 UTC

Dernière observation 13/10/2026 06:37 UTC

Événements (période) 725

MITRE ATT&CK principal T1083 290 occurrences

Pourquoi listée

Type « postgres_probe » (signaux protocolaires) · confiance 49%

Confiance 49 % — Score WAF 8

Décision

Restreindre

Risque élevé. Limitez le débit vers les services sensibles et réévaluez sous 24 h avant un blocage durable.

65/100 Confiance 49 % 725 événements T1083

À faire

Limiter le débit ou isoler 213.209.159.175 des services d’administration.
Surveiller les ports des dernières 24 h.
Passer en blocage si le régime devient une rafale ou si le score atteint 85.

Preuves JSON SOC

Note de ticket

IP 213.209.159.175
Décision : Restreindre
Score max : 65/100 (Élevé)
Confiance : 49 %
Période : 2026-09-13 → 2026-10-13 · 725 événements
Motif : Type « postgres_probe » (signaux protocolaires) · confiance 49%
DNSBL : 175.159.209.213.dnsbl.blacklistip.com → 127.0.0.3 (Sonde PostgreSQL)
MITRE : T1083
FAI : Feo Prest SRL · Allemagne

Comparaison ASN / FAI

ASN 208137 · 213.209.159.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 725 événements sur la période pour cette IP.

213.209.159.136 Sonde PPTP 13/10/2026 18:26 UTC
213.177.179.14 Sonde PostgreSQL 13/10/2026 12:36 UTC
213.209.159.54 Sonde SMTP (25/TCP) 13/10/2026 08:57 UTC
213.209.159.66 Sonde PostgreSQL 13/10/2026 07:03 UTC
213.177.179.195 Sonde RDP 13/10/2026 01:33 UTC
213.177.179.80 Sonde SSH 12/10/2026 21:03 UTC
213.177.179.12 Sonde HTTP 12/10/2026 17:16 UTC
213.177.179.62 Sonde SSH 12/10/2026 16:54 UTC

Événements (filtres)

725

Première observation

12/10/2026 22:06 UTC

Dernière observation

13/10/2026 06:37 UTC

Dernière activité (filtres)

13/10/2026 06:37 UTC

Événements 7j

725

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 438 DOCKER TCP 263 UPNP TCP TCP 8 KERBEROS TCP 7 HTTP ALT 81 TCP 4 TLS TCP 3

HTTP

438

DOCKER

263

UPNP TCP

KERBEROS

HTTP ALT 81

TLS

Géolocalisation

Origine réseau déclarée

Allemagne unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Feo Prest SRL 0 Port 5001 Sonde PostgreSQL

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

postgres probe · via UPNP TCP:5001 · (sonde / probe)

Détails protocole

Aperçu payload

��)�u�KC��"]l��j�7��.J g�mjw�D3-]1� `(Y�ƣi�xO�CS��+�/�,�0̨̩� �� u �

Port / service

5001 · UPNP TCP

Service émulé

UPNP-TCP

Raison confiance

Confiance 49 % — Motif catalogue confirmé

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0369

Confiance

49% Confiance modérée — signal unique

Famille de menace

scanner IP signalée (IPsum, 3 listes ou plus)

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

725 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

725 événement(s) — page 2/15

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
13/10/2026 03:19:52 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /.env.local.php	Élevée	Moyen · 61
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /.env.local.php UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.env.local.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /.env.local.php Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 61 Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive pat-0191 pat-0193 Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /.env Probe /.env.local Ligne de requête `GET /.env.local.php HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.env.local.php HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537 Requête brute (extrait) GET /.env.local.php HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "php", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "e7aa43e48ead79a153e7a9459efa971980be87ac", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 289, "payload_entropy": 5.430728321638031, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 61, "tag_count": 6, "anomaly_count": 0, "campaign_key": "3c0073e3397435395f1fc3e9f8f85763f8aec8f9", "event_fingerprint": "15e2e8e95ae566c11aebd0e702eada38ec97ce73", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 325, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "pat-0191", "pat-0193", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "pat-0191", "pat-0193", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0191", "pat-0193" ], "matched_pattern_names": [ "Probe \/.env", "Probe \/.env.local" ], "pattern_ids": [ "pat-0191", "pat-0193" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 61, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "1102a33ea332748d4db004ad0074eed7", "path_pattern_hash": "f836393cb9f6ab7eef41d535b14055cc" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "GET \/.env.local.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "method": "GET", "path": "\/.env.local.php", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.env.local.php HTTP\/1.1", "request_sample": "GET \/.env.local.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r", "payload_snippet": "GET \/.env.local.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "evidence": { "method": "GET", "path": "\/.env.local.php", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.env.local.php HTTP\/1.1", "request_sample": "GET \/.env.local.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r", "payload_snippet": "GET \/.env.local.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "677fe6687bc8be3af938a42cf7661350bdcaa423", "protocol_details": { "http_method": "GET", "http_path": "\/.env.local.php", "request_line": "GET \/.env.local.php HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.env.local.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.local.php", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 61, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "pat-0191", "pat-0193" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "pat-0191", "pat-0193" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/.env.local.php", "request_line": "GET \/.env.local.php HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.local.php", "evidence_snippet": "GET \/.env.local.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_probe_env_local", "http_sensitive_path" ] }
13/10/2026 03:19:52 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /.env.sample.php	Élevée	Moyen · 61
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /.env.sample.php UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950514:leak-1 http_backup_file_scan Cible HTTP GET /.env.sample.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /.env.sample.php Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 61 Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive pat-0191 Upstream Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /.env Ligne de requête `GET /.env.sample.php HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /.env.sample.php HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/53 Requête brute (extrait) GET /.env.sample.php HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "php", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "7086fda563333a5def48976c14245434add8ab9e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 290, "payload_entropy": 5.433859918451928, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 92, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.1, "risk_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 61, "tag_count": 5, "anomaly_count": 0, "campaign_key": "098a805691d4db70f503f62a078b05f6326fd393", "event_fingerprint": "4d47299ae8751dfa85d8e4275387c0575653328a", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 270, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "pat-0191", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "pat-0191", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0191" ], "matched_pattern_names": [ "Probe \/.env" ], "pattern_ids": [ "pat-0191" ], "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 61, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "6d5b08b9554ab4afb5e2ee159a5b6b5d", "path_pattern_hash": "1f8ca883f3092b769db2a69c0a565c26" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "GET \/.env.sample.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "method": "GET", "path": "\/.env.sample.php", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.env.sample.php HTTP\/1.1", "request_sample": "GET \/.env.sample.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/.env.sample.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "evidence": { "method": "GET", "path": "\/.env.sample.php", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/.env.sample.php HTTP\/1.1", "request_sample": "GET \/.env.sample.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/.env.sample.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "01abcfd1eb17985887fdf6d328425bff39ea1cae", "protocol_details": { "http_method": "GET", "http_path": "\/.env.sample.php", "request_line": "GET \/.env.sample.php HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.env.sample.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.sample.php", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 92, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 61, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "pat-0191", "INT-upstream" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "pat-0191", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/.env.sample.php", "request_line": "GET \/.env.sample.php HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.env.sample.php", "evidence_snippet": "GET \/.env.sample.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ] }
13/10/2026 03:19:52 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /env-config.js	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /env-config.js UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /env-config.js TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /env-config.js Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /env-config.js HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /env-config.js HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537. Requête brute (extrait) GET /env-config.js HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "js", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "25badcb09a6b6be98c45f09b7c0ffbfab663af4e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 288, "payload_entropy": 5.456134369207661, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "3f401bd80586786386b44ceec5978e9418f2ee41", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "30c4334bb48d358a3ac2dd6c06d5e84a", "path_pattern_hash": "0a0e58184f291db57d701d2bcbd12eff" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/env-config.js HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "method": "GET", "path": "\/env-config.js", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/env-config.js HTTP\/1.1", "request_sample": "GET \/env-config.js HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\n", "payload_snippet": "GET \/env-config.js HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "evidence": { "method": "GET", "path": "\/env-config.js", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/env-config.js HTTP\/1.1", "request_sample": "GET \/env-config.js HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\n", "payload_snippet": "GET \/env-config.js HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a96477b590fe11e5dcf06b65503c866f4892ad3e", "protocol_details": { "http_method": "GET", "http_path": "\/env-config.js", "request_line": "GET \/env-config.js HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/env-config.js HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/env-config.js", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/env-config.js", "request_line": "GET \/env-config.js HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/env-config.js", "evidence_snippet": "GET \/env-config.js HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:52 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /administrator/.env	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /administrator/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /administrator/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /administrator/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 65 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) ET Joomla admin ES admin GET Probe /administrator/ ActiveMQ console Ligne de requête `GET /administrator/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /administrator/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit Requête brute (extrait) GET /administrator/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-al Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "9f86f3b535632ca5edb2602f2c6ab32340d0870c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 293, "payload_entropy": 5.4401530102387134, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 7.3, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 65, "tag_count": 9, "anomaly_count": 0, "campaign_key": "9b69447d5ff172da561c4e157115821d150c23a5", "event_fingerprint": "fb4346f530251435d44fb9038c2dc84db88c9e7a", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0853", "pat-0341", "pat-0238", "pat-0606" ], "matched_pattern_names": [ "ET Joomla admin", "ES admin GET", "Probe \/administrator\/", "ActiveMQ console" ], "pattern_ids": [ "pat-0853", "pat-0341", "pat-0238", "pat-0606" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "5ec473bca080d796d01fa80ade177be5", "path_pattern_hash": "ff5e493f42c864400b04017658f85cc3" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/administrator\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "method": "GET", "path": "\/administrator\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/administrator\/.env HTTP\/1.1", "request_sample": "GET \/administrator\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-al", "payload_snippet": "GET \/administrator\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "evidence": { "method": "GET", "path": "\/administrator\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/administrator\/.env HTTP\/1.1", "request_sample": "GET \/administrator\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-al", "payload_snippet": "GET \/administrator\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "222bc073348701b25a89822b658f7467f95fb065", "protocol_details": { "http_method": "GET", "http_path": "\/administrator\/.env", "request_line": "GET \/administrator\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/administrator\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/administrator\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/administrator\/.env", "request_line": "GET \/administrator\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/administrator\/.env", "evidence_snippet": "GET \/administrator\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_admin_panel_probe", "http_admin_panel_scan", "http_backup_file_scan", "http_probe_joomla", "http_sensitive_path" ] }
13/10/2026 03:19:51 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /temp/.env	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /temp/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /temp/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /temp/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /temp/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /temp/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 ( Requête brute (extrait) GET /temp/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgr Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "a617862b9702a5eb0473c44d9afaf4e0da55a075", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 284, "payload_entropy": 5.4367076496531945, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af3aa362c32662853f96d0d721a947cdd48711a2", "event_fingerprint": "edb08329aeb52cef43b2b9c33f5ebacd9d9cc945", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "c5d1ce4bdef5fb4b937f03ce0341d5b6", "path_pattern_hash": "75ee17153df3d0dbe793fbb0bd486a6b" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/temp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "method": "GET", "path": "\/temp\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/temp\/.env HTTP\/1.1", "request_sample": "GET \/temp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/temp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "evidence": { "method": "GET", "path": "\/temp\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/temp\/.env HTTP\/1.1", "request_sample": "GET \/temp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/temp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ce0765436ed8b79f1f7d3f655039c91d3ef069b0", "protocol_details": { "http_method": "GET", "http_path": "\/temp\/.env", "request_line": "GET \/temp\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/temp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/temp\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/temp\/.env", "request_line": "GET \/temp\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/temp\/.env", "evidence_snippet": "GET \/temp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ] }
13/10/2026 03:19:51 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /tmp/.env	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /tmp/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /tmp/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /tmp/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /tmp/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /tmp/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (K Requête brute (extrait) GET /tmp/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgra Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "606cb8ac14dde0b6a700154242812cc24d72a39a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 283, "payload_entropy": 5.443223492267118, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af3aa362c32662853f96d0d721a947cdd48711a2", "event_fingerprint": "f27f52b55e71724f7f7274d2fdc0acb4e911150d", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "004a39ef7bb4c5ae4b2a466873beac0e", "path_pattern_hash": "4238aa7c586fdde889d3bc23ec72292d" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/tmp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "method": "GET", "path": "\/tmp\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/tmp\/.env HTTP\/1.1", "request_sample": "GET \/tmp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgra", "payload_snippet": "GET \/tmp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "evidence": { "method": "GET", "path": "\/tmp\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/tmp\/.env HTTP\/1.1", "request_sample": "GET \/tmp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgra", "payload_snippet": "GET \/tmp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "53341efac10fc3e789e00b3c061eb55a3ed0bee2", "protocol_details": { "http_method": "GET", "http_path": "\/tmp\/.env", "request_line": "GET \/tmp\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/tmp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tmp\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/tmp\/.env", "request_line": "GET \/tmp\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tmp\/.env", "evidence_snippet": "GET \/tmp\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ] }
13/10/2026 03:19:51 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /storage/.env	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /storage/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /storage/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /storage/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /storage/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /storage/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.3 Requête brute (extrait) GET /storage/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive U Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "b8ca2ea5c794124cded93c100b20da74277adc4e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 287, "payload_entropy": 5.429536000112481, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af3aa362c32662853f96d0d721a947cdd48711a2", "event_fingerprint": "ed8ef1c540a089d440376bda25963e6f23801201", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "3a2b68b5e22c168a15503c0403ed9093", "path_pattern_hash": "450e48008d46f59e9e14143fd8de05b2" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "method": "GET", "path": "\/storage\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/storage\/.env HTTP\/1.1", "request_sample": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "evidence": { "method": "GET", "path": "\/storage\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/storage\/.env HTTP\/1.1", "request_sample": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7389aca5cad9530ca213cd1da2ddf263f5ae55ac", "protocol_details": { "http_method": "GET", "http_path": "\/storage\/.env", "request_line": "GET \/storage\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/storage\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/storage\/.env", "request_line": "GET \/storage\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/storage\/.env", "evidence_snippet": "GET \/storage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ] }
13/10/2026 03:19:50 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /htdocs/.env	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /htdocs/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /htdocs/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /htdocs/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /htdocs/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /htdocs/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 Requête brute (extrait) GET /htdocs/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Up Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "8f48488caec0125a8a05acdcda0c91818dd79982", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 286, "payload_entropy": 5.445537793444551, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af3aa362c32662853f96d0d721a947cdd48711a2", "event_fingerprint": "6b46213a72e0393e5659612825848ac89d307146", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "ce4f7c6de5fdb5ebcde0281c0bfe1f0d", "path_pattern_hash": "43bb577a72550f9d83432629be23ae6a" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "method": "GET", "path": "\/htdocs\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/htdocs\/.env HTTP\/1.1", "request_sample": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUp", "payload_snippet": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "evidence": { "method": "GET", "path": "\/htdocs\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/htdocs\/.env HTTP\/1.1", "request_sample": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUp", "payload_snippet": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5584273d3b043bad3da55fd4d580f8f394bdb064", "protocol_details": { "http_method": "GET", "http_path": "\/htdocs\/.env", "request_line": "GET \/htdocs\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/htdocs\/.env", "request_line": "GET \/htdocs\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/htdocs\/.env", "evidence_snippet": "GET \/htdocs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ] }
13/10/2026 03:19:50 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /public/.env	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /public/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /public/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /public/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /public/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /public/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 Requête brute (extrait) GET /public/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Up Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "bc9ca66c038b10c68f8dffc886361c52fc1ac680", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 286, "payload_entropy": 5.445740665787711, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af3aa362c32662853f96d0d721a947cdd48711a2", "event_fingerprint": "a9229058622420d85fe72f09e694d0593e2f9592", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "7953368da908deec219ac7272cb1b957", "path_pattern_hash": "6cf746da949d58c839550a31197db646" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "method": "GET", "path": "\/public\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/public\/.env HTTP\/1.1", "request_sample": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUp", "payload_snippet": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "evidence": { "method": "GET", "path": "\/public\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/public\/.env HTTP\/1.1", "request_sample": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUp", "payload_snippet": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "486b52e8011fd98b662b602ad3d65136bfe375b2", "protocol_details": { "http_method": "GET", "http_path": "\/public\/.env", "request_line": "GET \/public\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/public\/.env", "request_line": "GET \/public\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/.env", "evidence_snippet": "GET \/public\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ] }
13/10/2026 03:19:50 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /logs/.env	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /logs/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /logs/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /logs/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /logs/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /logs/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 ( Requête brute (extrait) GET /logs/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgr Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "1bdd0e55a197930fe54be8c4ba742a854d780c9f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 284, "payload_entropy": 5.438775485898896, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 7, "anomaly_count": 0, "campaign_key": "c519a720a3d79c4e37e79b6e5b84e3cbece73508", "event_fingerprint": "70e50834a0d8597a0c5bc2de2c9732a5d4683275", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "a0ca1a83ef1a6a94524ae2c367b29776", "path_pattern_hash": "ceba4fb5fae3a29907948f8b6ea7224f" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/logs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "method": "GET", "path": "\/logs\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/logs\/.env HTTP\/1.1", "request_sample": "GET \/logs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/logs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "evidence": { "method": "GET", "path": "\/logs\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/logs\/.env HTTP\/1.1", "request_sample": "GET \/logs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/logs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5711483f4cef2341ebae1520c5b4d081e4c1baea", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/.env", "request_line": "GET \/logs\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/logs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/.env", "request_line": "GET \/logs\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/logs\/.env", "evidence_snippet": "GET \/logs\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_probe_logs", "http_sensitive_path" ] }
13/10/2026 03:19:50 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /log/.env	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /log/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /log/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /log/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /log/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /log/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (K Requête brute (extrait) GET /log/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgra Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "a6ee5424425a3a49e80b9e1262f687983165a3ec", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 283, "payload_entropy": 5.438742219884995, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 7, "anomaly_count": 0, "campaign_key": "66bcb1a10ac7d242d1925998497578dbb4c9d8a6", "event_fingerprint": "8dd5e09918f8889e9417989fbc3d3e386b7600b1", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "161f26d2b3f05a499b67ab9d09119f28", "path_pattern_hash": "65e5d08ea6f9fb23e081cc1ace89a499" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/log\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "method": "GET", "path": "\/log\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/log\/.env HTTP\/1.1", "request_sample": "GET \/log\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgra", "payload_snippet": "GET \/log\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "evidence": { "method": "GET", "path": "\/log\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/log\/.env HTTP\/1.1", "request_sample": "GET \/log\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgra", "payload_snippet": "GET \/log\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "69eb515dad6b781f79a3172120775165566d17fa", "protocol_details": { "http_method": "GET", "http_path": "\/log\/.env", "request_line": "GET \/log\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/log\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/log\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/log\/.env", "request_line": "GET \/log\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/log\/.env", "evidence_snippet": "GET \/log\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_probe_log", "http_sensitive_path" ] }
13/10/2026 03:19:50 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /cache/.env	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /cache/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /cache/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /cache/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /cache/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /cache/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 Requête brute (extrait) GET /cache/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upg Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "7a1c7c79e5b6bebbacd4d9aa35263510f5511a03", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 285, "payload_entropy": 5.429762634378632, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af3aa362c32662853f96d0d721a947cdd48711a2", "event_fingerprint": "ed38b322b784d5333e0060cddd92da3cb1e2a868", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "7fdb72f9550cd40c21a0e158c8162227", "path_pattern_hash": "001212743430335e69211a193c25acf8" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/cache\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 ", "method": "GET", "path": "\/cache\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/cache\/.env HTTP\/1.1", "request_sample": "GET \/cache\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpg", "payload_snippet": "GET \/cache\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "evidence": { "method": "GET", "path": "\/cache\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/cache\/.env HTTP\/1.1", "request_sample": "GET \/cache\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpg", "payload_snippet": "GET \/cache\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1b418333a442232addab4931034c240e8a5f3cf7", "protocol_details": { "http_method": "GET", "http_path": "\/cache\/.env", "request_line": "GET \/cache\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cache\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cache\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/cache\/.env", "request_line": "GET \/cache\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cache\/.env", "evidence_snippet": "GET \/cache\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ] }
13/10/2026 03:19:49 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /api/.git/config	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /api/.git/config UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 31 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950513:leak-0 Cible HTTP GET /api/.git/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /api/.git/config Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 65 Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /api/.git/config HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-0 k8s-api Payload (extrait) GET /api/.git/config HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/53 Requête brute (extrait) GET /api/.git/config HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "git\/config", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "4d60538c38eae0fe13cbc99a2ea3645cbb337669", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 290, "payload_entropy": 5.435402438429777, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 7.3, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 65, "tag_count": 9, "anomaly_count": 0, "campaign_key": "c578ef191d074509a16cd5aa797c860e51581a62", "event_fingerprint": "36c3a427b3a148770ada392645ca0051863d9cc7", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "2f5f58c4e6536bf0084b7a248d49329c", "path_pattern_hash": "3ed56f63a5d3aef03e8853abb49b3eea" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "method": "GET", "path": "\/api\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0", "k8s-api" ], "request_line": "GET \/api\/.git\/config HTTP\/1.1", "request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "evidence": { "method": "GET", "path": "\/api\/.git\/config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-0", "k8s-api" ], "request_line": "GET \/api\/.git\/config HTTP\/1.1", "request_sample": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8f19dfa5f86a17ed091ebb1c505e39ec11ab02da", "protocol_details": { "http_method": "GET", "http_path": "\/api\/.git\/config", "request_line": "GET \/api\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/api\/.git\/config", "request_line": "GET \/api\/.git\/config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.git\/config", "evidence_snippet": "GET \/api\/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950513:leak-0", "950600:k8s-api", "http_backup_file_scan", "http_git_exposure", "http_probe_api", "http_sensitive_path" ] }
13/10/2026 03:19:49 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /beta/	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /beta/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_beta Cible HTTP GET /beta/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /beta/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /beta/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /beta/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /beta/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade- Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "15a6e5c76b5b6bc2f7131f93a4fa5bc89997d146", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 280, "payload_entropy": 5.439090117531171, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ca0523feb411e488354dc37905d588e36dc7235c", "event_fingerprint": "d83e77b8bcf47452ca78b03925ec7122798ff799", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "ca379dfc13ba395b1f44a28590ed546f", "path_pattern_hash": "ec35f52f15892df8780e3b07318f9627" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/beta\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "method": "GET", "path": "\/beta\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/beta\/ HTTP\/1.1", "request_sample": "GET \/beta\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/beta\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "evidence": { "method": "GET", "path": "\/beta\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/beta\/ HTTP\/1.1", "request_sample": "GET \/beta\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/beta\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f71666ddfd03e01ca15ee697393dddc60824b5e8", "protocol_details": { "http_method": "GET", "http_path": "\/beta\/", "request_line": "GET \/beta\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/beta\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/beta\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/beta\/", "request_line": "GET \/beta\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/beta\/", "evidence_snippet": "GET \/beta\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_beta" ] }
13/10/2026 03:19:49 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /configuration.json	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /configuration.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /configuration.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /configuration.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /configuration.json HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /configuration.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit Requête brute (extrait) GET /configuration.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-al Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "e32d404f5333e29c1e2e23b69c8ddbaaf264578b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 293, "payload_entropy": 5.447809774412833, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "dcf7e1bf66bf167f2cffca9574c10cca6819eb9c", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "baf4a9a6838d3faa55d9db11942122dd", "path_pattern_hash": "88bd1f331f23c792e938b0094c3748e0" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/configuration.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "method": "GET", "path": "\/configuration.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configuration.json HTTP\/1.1", "request_sample": "GET \/configuration.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-al", "payload_snippet": "GET \/configuration.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "evidence": { "method": "GET", "path": "\/configuration.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configuration.json HTTP\/1.1", "request_sample": "GET \/configuration.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-al", "payload_snippet": "GET \/configuration.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "750396faa3301b30ff6ff6e03fc91f355806f0b2", "protocol_details": { "http_method": "GET", "http_path": "\/configuration.json", "request_line": "GET \/configuration.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/configuration.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/configuration.json", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/configuration.json", "request_line": "GET \/configuration.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/configuration.json", "evidence_snippet": "GET \/configuration.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:49 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /configuration.xml	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /configuration.xml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /configuration.xml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /configuration.xml Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /configuration.xml HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /configuration.xml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/ Requête brute (extrait) GET /configuration.xml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-ali Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "xml", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "8e32c3e6150268d24c13bbf1e9f63b4e7a05c965", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 292, "payload_entropy": 5.4601006815523245, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "8b0932bef80c22c8b6a0984c757ba155abff7351", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "465753cef18897c1220f44aceed57cab", "path_pattern_hash": "57bca992457ab14e338a79cfc419fdc7" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/configuration.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "method": "GET", "path": "\/configuration.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configuration.xml HTTP\/1.1", "request_sample": "GET \/configuration.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-ali", "payload_snippet": "GET \/configuration.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "evidence": { "method": "GET", "path": "\/configuration.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configuration.xml HTTP\/1.1", "request_sample": "GET \/configuration.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-ali", "payload_snippet": "GET \/configuration.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7eb1e2ea6eac2c17217374ac03cce7dd91f8db7e", "protocol_details": { "http_method": "GET", "http_path": "\/configuration.xml", "request_line": "GET \/configuration.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/configuration.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/configuration.xml", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/configuration.xml", "request_line": "GET \/configuration.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/configuration.xml", "evidence_snippet": "GET \/configuration.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:49 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /configuration.yaml	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /configuration.yaml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /configuration.yaml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /configuration.yaml Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /configuration.yaml HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /configuration.yaml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit Requête brute (extrait) GET /configuration.yaml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-al Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yaml", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "cc730428070afb38285aefe62c0f6986c02c4eef", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 293, "payload_entropy": 5.457849553958691, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "b4090da9841331e3b1cb2ec221bab0387b9916ab", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "53fbb87112d642f2d49b8a062c041c43", "path_pattern_hash": "03f090b25a908f6e6a46e0ff7e85ff64" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/configuration.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "method": "GET", "path": "\/configuration.yaml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configuration.yaml HTTP\/1.1", "request_sample": "GET \/configuration.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-al", "payload_snippet": "GET \/configuration.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "evidence": { "method": "GET", "path": "\/configuration.yaml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/configuration.yaml HTTP\/1.1", "request_sample": "GET \/configuration.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-al", "payload_snippet": "GET \/configuration.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ef583296d70cd7a78a74c102cae544be1bfc1c30", "protocol_details": { "http_method": "GET", "http_path": "\/configuration.yaml", "request_line": "GET \/configuration.yaml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/configuration.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/configuration.yaml", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/configuration.yaml", "request_line": "GET \/configuration.yaml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/configuration.yaml", "evidence_snippet": "GET \/configuration.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:49 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /credentials.ini	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /credentials.ini UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /credentials.ini TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /credentials.ini Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /credentials.ini HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /credentials.ini HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/53 Requête brute (extrait) GET /credentials.ini HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ini", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "1fe933f2426f3d070219d7176dd7a40190e5cf29", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 290, "payload_entropy": 5.420908922973239, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "0f0c5062b943223ee5f3e5d0419c64ae36c94b90", "event_fingerprint": "aa0f3ab8d30d3d8a37ad914c34dab7e50e1e8a54", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "bc37af491db22391c62818ebbde59dd2", "path_pattern_hash": "f678ce5b66695a84c83f0328065c2c74" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/credentials.ini HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "method": "GET", "path": "\/credentials.ini", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/credentials.ini HTTP\/1.1", "request_sample": "GET \/credentials.ini HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/credentials.ini HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "evidence": { "method": "GET", "path": "\/credentials.ini", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/credentials.ini HTTP\/1.1", "request_sample": "GET \/credentials.ini HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/credentials.ini HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0728b70da0707c0a6fbfbe2b35613c3e65323c1b", "protocol_details": { "http_method": "GET", "http_path": "\/credentials.ini", "request_line": "GET \/credentials.ini HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/credentials.ini HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/credentials.ini", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/credentials.ini", "request_line": "GET \/credentials.ini HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/credentials.ini", "evidence_snippet": "GET \/credentials.ini HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:49 UTC	TCP	5173 · HTTP	http	Sonde fichier credential / clé credential file probe · via HTTP:5173 · (tentative d'exploit) · → /credentials.xml	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /credentials.xml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /credentials.xml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /credentials.xml Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF Signaux pat-0473 Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Credentials XML Ligne de requête `GET /credentials.xml HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /credentials.xml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/53 Requête brute (extrait) GET /credentials.xml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "xml", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "81281a73f36668c22cb77f431e0bd35ebe7a0ec2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 290, "payload_entropy": 5.447931569893654, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 82, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 52, "tag_count": 2, "anomaly_count": 0, "campaign_key": "0f0c5062b943223ee5f3e5d0419c64ae36c94b90", "event_fingerprint": "fc7037e021a0f9907b0b41a9b3c7bbf1d629ae30", "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 135, "precision_signals": [ "pat-0473", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "pat-0473", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0473" ], "matched_pattern_names": [ "Cred Credentials XML" ], "pattern_ids": [ "pat-0473" ], "confidence_breakdown": { "waf": 60, "classification": 82, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "lfi_attack", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "300825ce659e0d487f1ca4d8191b00a8", "path_pattern_hash": "7f193fe8fcf321be8c1aa2623fdd9688" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/credentials.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "method": "GET", "path": "\/credentials.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/credentials.xml HTTP\/1.1", "request_sample": "GET \/credentials.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/credentials.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "evidence": { "method": "GET", "path": "\/credentials.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/credentials.xml HTTP\/1.1", "request_sample": "GET \/credentials.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/credentials.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "33e974c8dedd5d859204123d9b4dbde3c607b5f0", "protocol_details": { "http_method": "GET", "http_path": "\/credentials.xml", "request_line": "GET \/credentials.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/credentials.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "attack_vector": "credential file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.xml", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 60, "classification": 82, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "pat-0473", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "pat-0473", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/credentials.xml", "request_line": "GET \/credentials.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "credential file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.xml", "evidence_snippet": "GET \/credentials.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:48 UTC	TCP	5173 · HTTP	http	Traversal LFI lfi path traversal · via HTTP:5173 · (tentative d'exploit) · → /crossdomain.xml	Élevée	Moyen · 45
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /crossdomain.xml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /crossdomain.xml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /crossdomain.xml Service HTTP Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé · 2 tag(s) WAF Signaux pat-0116 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Flash crossdomain Ligne de requête `GET /crossdomain.xml HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /crossdomain.xml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/53 Requête brute (extrait) GET /crossdomain.xml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "xml", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "c19a59a0ba2e15f5bfcdb6df1c1ac0d1936ec7a3", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 290, "payload_entropy": 5.465134439833099, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 78, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 45, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "3e932e50032a24e4c584fa86b1682f36be54dfcf", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 66, "precision_signals": [ "pat-0116" ], "kb_rule_ids": [ "pat-0116" ], "matched_patterns": [ "pat-0116" ], "matched_pattern_names": [ "LFI Flash crossdomain" ], "pattern_ids": [ "pat-0116" ], "confidence_breakdown": { "waf": 60, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "path_traversal", "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "68904cc36f6e2b04e6e2fe3c0d99e31c", "path_pattern_hash": "87344fab075946f529b0541e60b7f956" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 45 }, "payload_preview": "GET \/crossdomain.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "method": "GET", "path": "\/crossdomain.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/crossdomain.xml HTTP\/1.1", "request_sample": "GET \/crossdomain.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/crossdomain.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "evidence": { "method": "GET", "path": "\/crossdomain.xml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/crossdomain.xml HTTP\/1.1", "request_sample": "GET \/crossdomain.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/crossdomain.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f0da1c239e09dca6f86acd7228b21ea3c39ec329", "protocol_details": { "http_method": "GET", "http_path": "\/crossdomain.xml", "request_line": "GET \/crossdomain.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/crossdomain.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "attack_vector": "lfi path traversal \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/crossdomain.xml", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 60, "classification": 78, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 45, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "pat-0116" ], "tags_summary_labels_fr": [ "pat-0116" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/crossdomain.xml", "request_line": "GET \/crossdomain.xml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "lfi path traversal \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/crossdomain.xml", "evidence_snippet": "GET \/crossdomain.xml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:48 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /database.config	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /database.config UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /database.config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /database.config Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /database.config HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /database.config HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/53 Requête brute (extrait) GET /database.config HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "config", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "b4eac1ee8f157847b43a00ccdc198d785350c36a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 290, "payload_entropy": 5.443204361182433, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "264c45cc97cc6ec26bd29dad0260f8ce43b20498", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "dc69167d446753f09a31012cc77e3169", "path_pattern_hash": "17551631a58424436558a5e7e16ed332" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/database.config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "method": "GET", "path": "\/database.config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/database.config HTTP\/1.1", "request_sample": "GET \/database.config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/database.config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "evidence": { "method": "GET", "path": "\/database.config", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/database.config HTTP\/1.1", "request_sample": "GET \/database.config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/database.config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e0a3b4d7b085fa81982f3e69de9cada0a8ef454f", "protocol_details": { "http_method": "GET", "http_path": "\/database.config", "request_line": "GET \/database.config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/database.config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/database.config", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/database.config", "request_line": "GET \/database.config HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/database.config", "evidence_snippet": "GET \/database.config HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:48 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /demo/	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /demo/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /demo/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /demo/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /demo/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /demo/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /demo/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade- Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "34dbac07a572d7a89e5094fdf9bf3ec0469cc46f", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 280, "payload_entropy": 5.449916532981845, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 49, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7b08deda610021d220859a92fdf15f9daba1ba8c", "event_fingerprint": "c936a71adc08ff427390d09c158cdc3b71081178", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "5554eb2b284e62ea53789e228e0c1382", "path_pattern_hash": "567e34c9ddcab3b259a1a0f1ace3ec5e" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/demo\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "method": "GET", "path": "\/demo\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/demo\/ HTTP\/1.1", "request_sample": "GET \/demo\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/demo\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "evidence": { "method": "GET", "path": "\/demo\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/demo\/ HTTP\/1.1", "request_sample": "GET \/demo\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/demo\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "16ecfb547e8713d25d9597f1427d92d154037063", "protocol_details": { "http_method": "GET", "http_path": "\/demo\/", "request_line": "GET \/demo\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/demo\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/demo\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/demo\/", "request_line": "GET \/demo\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/demo\/", "evidence_snippet": "GET \/demo\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ] }
13/10/2026 03:19:48 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /dev/	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /dev/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_dev Cible HTTP GET /dev/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /dev/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /dev/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /dev/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML Requête brute (extrait) GET /dev/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-I Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "8967fe22f61d2a1bbad94f8513caa594a9ebb2d1", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 279, "payload_entropy": 5.450737440990198, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "93bd4c576187ffd26f9fd66c417074dbd9e8817d", "event_fingerprint": "55e360efe1ce776963c6a4ce2cd2cbe819db5dbc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "295b03ef95ec17fe591c4311b581e7a2", "path_pattern_hash": "e020c3e0593c1f9e4c0f55cfbcaef1c6" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/dev\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "method": "GET", "path": "\/dev\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/dev\/ HTTP\/1.1", "request_sample": "GET \/dev\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-I", "payload_snippet": "GET \/dev\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "evidence": { "method": "GET", "path": "\/dev\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/dev\/ HTTP\/1.1", "request_sample": "GET \/dev\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-I", "payload_snippet": "GET \/dev\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7284b7e72e6fd817bc409b1349333161f1f9c0dd", "protocol_details": { "http_method": "GET", "http_path": "\/dev\/", "request_line": "GET \/dev\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/dev\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/dev\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/dev\/", "request_line": "GET \/dev\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/dev\/", "evidence_snippet": "GET \/dev\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_dev" ] }
13/10/2026 03:19:48 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /kubernetes/secrets.yaml	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /kubernetes/secrets.yaml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_k8s_probe Cible HTTP GET /kubernetes/secrets.yaml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /kubernetes/secrets.yaml Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Motifs de détection (base) Probe /kubernetes/ Ligne de requête `GET /kubernetes/secrets.yaml HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /kubernetes/secrets.yaml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleW Requête brute (extrait) GET /kubernetes/secrets.yaml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: ke Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "yaml", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "46fcf21a143d6ce7b03143ec5ce4c3d1b460a985", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 298, "payload_entropy": 5.4318796959952325, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "820e8052c941b7e50165f29869109fee00763707", "event_fingerprint": "207e3b8cc31703a0d01a62cd84cafd45d0e03d39", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "matched_patterns": [ "pat-0216" ], "matched_pattern_names": [ "Probe \/kubernetes\/" ], "pattern_ids": [ "pat-0216" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "deb0ceb850d8310e6f110552a9237557", "path_pattern_hash": "db0a7ad2d9d66d2db43b839a246a12ad" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleW", "method": "GET", "path": "\/kubernetes\/secrets.yaml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/kubernetes\/secrets.yaml HTTP\/1.1", "request_sample": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: ke", "payload_snippet": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleW", "evidence": { "method": "GET", "path": "\/kubernetes\/secrets.yaml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/kubernetes\/secrets.yaml HTTP\/1.1", "request_sample": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: ke", "payload_snippet": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleW", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "19174af0e6ecf5e4f52bb791451dc40ef3d8df63", "protocol_details": { "http_method": "GET", "http_path": "\/kubernetes\/secrets.yaml", "request_line": "GET \/kubernetes\/secrets.yaml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleW", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/secrets.yaml", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/kubernetes\/secrets.yaml", "request_line": "GET \/kubernetes\/secrets.yaml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/kubernetes\/secrets.yaml", "evidence_snippet": "GET \/kubernetes\/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleW", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_k8s_probe" ] }
13/10/2026 03:19:47 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /laravel.log	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /laravel.log UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path Cible HTTP GET /laravel.log TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /laravel.log Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /laravel.log HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /laravel.log HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 Requête brute (extrait) GET /laravel.log HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Up Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "log", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "5dd8c8bb33603d1ad2c91357a5bdf5e4a77e2fda", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 286, "payload_entropy": 5.436466966244372, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "3977ea184f580781070c37472c2805f385ac19fa", "event_fingerprint": "681d4262eca70b8da9f0661cfc3416da5885dda4", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "c3d8be1c02fa8f462e4c27230c2aec80", "path_pattern_hash": "e42ca631e5a6c090d1fddca82a4d1723" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "method": "GET", "path": "\/laravel.log", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/laravel.log HTTP\/1.1", "request_sample": "GET \/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUp", "payload_snippet": "GET \/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "evidence": { "method": "GET", "path": "\/laravel.log", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/laravel.log HTTP\/1.1", "request_sample": "GET \/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUp", "payload_snippet": "GET \/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6dad406cb118daf97dfd884bec0a007403b7ee02", "protocol_details": { "http_method": "GET", "http_path": "\/laravel.log", "request_line": "GET \/laravel.log HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/laravel.log", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/laravel.log", "request_line": "GET \/laravel.log HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/laravel.log", "evidence_snippet": "GET \/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "http_sensitive_path" ] }
13/10/2026 03:19:47 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /log/	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /log/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_log Cible HTTP GET /log/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /log/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /log/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /log/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML Requête brute (extrait) GET /log/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-I Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "53a421ef5870a3fd64494054825cabb009fecf93", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 279, "payload_entropy": 5.4429760213098435, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "6c6a4270b5edaa7ca700d77433effeb1091a61a5", "event_fingerprint": "c8647091a808f19982d3ffdfc0fbdddf1be5cc7e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "49f952b5658bae9eebca8fe73f06734c", "path_pattern_hash": "2ec293303d3b6456e5075bbbe34a6f41" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "method": "GET", "path": "\/log\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/log\/ HTTP\/1.1", "request_sample": "GET \/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-I", "payload_snippet": "GET \/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "evidence": { "method": "GET", "path": "\/log\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/log\/ HTTP\/1.1", "request_sample": "GET \/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-I", "payload_snippet": "GET \/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b95faee0ec75c084f6476e21f70bba3b6890c74e", "protocol_details": { "http_method": "GET", "http_path": "\/log\/", "request_line": "GET \/log\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/log\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/log\/", "request_line": "GET \/log\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/log\/", "evidence_snippet": "GET \/log\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_log" ] }
13/10/2026 03:19:47 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /logs/	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /logs/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_logs Cible HTTP GET /logs/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /logs/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /logs/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /logs/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade- Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "6a3a0a8f8e2438fff5a15d99a9a8d4b05eba0362", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 280, "payload_entropy": 5.442921425855779, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1beb193915c05998bfa7d0e2a01e6452173318f6", "event_fingerprint": "0fe81c8e9c5ae880a23837623e8446107434d62b", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "72fbdb8d1142421dcaeee20fb8556b93", "path_pattern_hash": "dc3c49e2c93155841e5992c42eedc899" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "evidence": { "method": "GET", "path": "\/logs\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/logs\/ HTTP\/1.1", "request_sample": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "476929489ac28963c7d03dc638970cb90500b2a1", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/logs\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/logs\/", "request_line": "GET \/logs\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/logs\/", "evidence_snippet": "GET \/logs\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_logs" ] }
13/10/2026 03:19:47 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /mysql.sql	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /mysql.sql UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_backup_path Cible HTTP GET /mysql.sql TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /mysql.sql Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /mysql.sql HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /mysql.sql HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 ( Requête brute (extrait) GET /mysql.sql HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgr Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "sql", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "016bc72d0bdacbfdce096456103df4d3e84db013", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 284, "payload_entropy": 5.468277375722362, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f6dc9fbed32415355291adab341c4e4e7fe5a937", "event_fingerprint": "d181bb2098dc429a1a1b0a801a2a7f4cbb1a0abc", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "2b899dfd4710e40b3c8d143fe075fb97", "path_pattern_hash": "7ce91b5f05e43ecf92c43f2a525600f7" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/mysql.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "method": "GET", "path": "\/mysql.sql", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/mysql.sql HTTP\/1.1", "request_sample": "GET \/mysql.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/mysql.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "evidence": { "method": "GET", "path": "\/mysql.sql", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/mysql.sql HTTP\/1.1", "request_sample": "GET \/mysql.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/mysql.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5e3c5340f427c45f12a2330f71d9e88ff9388ac3", "protocol_details": { "http_method": "GET", "http_path": "\/mysql.sql", "request_line": "GET \/mysql.sql HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/mysql.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/mysql.sql", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/mysql.sql", "request_line": "GET \/mysql.sql HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/mysql.sql", "evidence_snippet": "GET \/mysql.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "http_backup_path" ] }
13/10/2026 03:19:47 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /package-lock.json	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /package-lock.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /package-lock.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /package-lock.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /package-lock.json HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /package-lock.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/ Requête brute (extrait) GET /package-lock.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-ali Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "156babdb9b53ca52004f470fe579620642fb3aff", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 292, "payload_entropy": 5.442277398373469, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "c2aa6dd88d4dbc3be8650a6195dd2b630d215dc9", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "63b1934328652bfcd657f382f1814b24", "path_pattern_hash": "38a3eaee41f005f4fe810a7db304e685" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/package-lock.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "method": "GET", "path": "\/package-lock.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/package-lock.json HTTP\/1.1", "request_sample": "GET \/package-lock.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-ali", "payload_snippet": "GET \/package-lock.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "evidence": { "method": "GET", "path": "\/package-lock.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/package-lock.json HTTP\/1.1", "request_sample": "GET \/package-lock.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-ali", "payload_snippet": "GET \/package-lock.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4aa6214fc39b93abe25a2b79e309c9863f9ed459", "protocol_details": { "http_method": "GET", "http_path": "\/package-lock.json", "request_line": "GET \/package-lock.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/package-lock.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/package-lock.json", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/package-lock.json", "request_line": "GET \/package-lock.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/package-lock.json", "evidence_snippet": "GET \/package-lock.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:47 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /package.json	Élevée	Moyen · 53
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /package.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950516:leak-3 http_probe_package Cible HTTP GET /package.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /package.json Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 53 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Motifs de détection (base) Probe /package.json Ligne de requête `GET /package.json HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-3 Payload (extrait) GET /package.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.3 Requête brute (extrait) GET /package.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive U Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "f42f55a301ffbcbc214ff66b9aeb43a4a1604046", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 287, "payload_entropy": 5.443558774674968, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 92, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 92, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 53, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d246a660bc1494b32bffecc73bb36dcd2d08e2c9", "event_fingerprint": "a69666122988d6380ed402a3b81bbce00e065cbb", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "matched_patterns": [ "pat-0268" ], "matched_pattern_names": [ "Probe \/package.json" ], "pattern_ids": [ "pat-0268" ], "confidence_breakdown": { "waf": 92, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "d37431fa7ac06b7d05c13f77d936a91d", "path_pattern_hash": "545332ac15012117358e30c0f45950b6" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "method": "GET", "path": "\/package.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950516:leak-3" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-3" ], "request_line": "GET \/package.json HTTP\/1.1", "request_sample": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "evidence": { "method": "GET", "path": "\/package.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950516:leak-3" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-3" ], "request_line": "GET \/package.json HTTP\/1.1", "request_sample": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "600b9820a88b76f44d1ca179766f20bc5b82e959", "protocol_details": { "http_method": "GET", "http_path": "\/package.json", "request_line": "GET \/package.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/package.json", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 92, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/package.json", "request_line": "GET \/package.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/package.json", "evidence_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950516:leak-3", "http_probe_package" ] }
13/10/2026 03:19:46 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /php_error.log	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /php_error.log UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /php_error.log TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /php_error.log Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /php_error.log HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /php_error.log HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537. Requête brute (extrait) GET /php_error.log HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "log", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "a103433c04f7401669a3dac3d8dcc7745f46f7be", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 288, "payload_entropy": 5.442456471474334, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b243d053a43c268d0bcb7c329d0b03a0aa8356d9", "event_fingerprint": "b4faa3487eadd86f8bc9699ac92297d3dfaf6b8e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "c643a30aaea59009c5788f307a545720", "path_pattern_hash": "ce549c9646d37d4e4725d00e2315ecfb" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/php_error.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "method": "GET", "path": "\/php_error.log", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/php_error.log HTTP\/1.1", "request_sample": "GET \/php_error.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\n", "payload_snippet": "GET \/php_error.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "evidence": { "method": "GET", "path": "\/php_error.log", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/php_error.log HTTP\/1.1", "request_sample": "GET \/php_error.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\n", "payload_snippet": "GET \/php_error.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0cf82e8c22ec59679a2cd5a3a97f8a6dbafd5c5f", "protocol_details": { "http_method": "GET", "http_path": "\/php_error.log", "request_line": "GET \/php_error.log HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/php_error.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/php_error.log", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/php_error.log", "request_line": "GET \/php_error.log HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/php_error.log", "evidence_snippet": "GET \/php_error.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:46 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /php_errors.log	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /php_errors.log UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /php_errors.log TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /php_errors.log Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /php_errors.log HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /php_errors.log HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537 Requête brute (extrait) GET /php_errors.log HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "log", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "8bf7cc9280b6b448f224040109cfce24551e25f0", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 289, "payload_entropy": 5.442563585335092, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b243d053a43c268d0bcb7c329d0b03a0aa8356d9", "event_fingerprint": "59a64cc5266c058e3cf2e8611926474ed3543277", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "57dd734e5ff24e1ddfb8354bd7cd2729", "path_pattern_hash": "9fa95576d557a4f39edebf6d36fc655c" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/php_errors.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "method": "GET", "path": "\/php_errors.log", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/php_errors.log HTTP\/1.1", "request_sample": "GET \/php_errors.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r", "payload_snippet": "GET \/php_errors.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "evidence": { "method": "GET", "path": "\/php_errors.log", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/php_errors.log HTTP\/1.1", "request_sample": "GET \/php_errors.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r", "payload_snippet": "GET \/php_errors.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fd920ccfe46f072ff7e34e0c18c1e35a95a5df5d", "protocol_details": { "http_method": "GET", "http_path": "\/php_errors.log", "request_line": "GET \/php_errors.log HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/php_errors.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/php_errors.log", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/php_errors.log", "request_line": "GET \/php_errors.log HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/php_errors.log", "evidence_snippet": "GET \/php_errors.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:46 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /readme.md	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /readme.md UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /readme.md TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /readme.md Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /readme.md HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /readme.md HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 ( Requête brute (extrait) GET /readme.md HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgr Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "md", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "874a117e4a05c3e8661d76ab32cb64b3a1be170a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 284, "payload_entropy": 5.45049209443345, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "af518f68091db9608a566acfecbd3cccd8ea064e", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "f8405657639182637632b4efb4f96b39", "path_pattern_hash": "dc4a31b61ba34aa89fa07c7650773947" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/readme.md HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "method": "GET", "path": "\/readme.md", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/readme.md HTTP\/1.1", "request_sample": "GET \/readme.md HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/readme.md HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "evidence": { "method": "GET", "path": "\/readme.md", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/readme.md HTTP\/1.1", "request_sample": "GET \/readme.md HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/readme.md HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fcfc4048063a5137cc64bd471829b2fe05228ee5", "protocol_details": { "http_method": "GET", "http_path": "\/readme.md", "request_line": "GET \/readme.md HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/readme.md HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/readme.md", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/readme.md", "request_line": "GET \/readme.md HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/readme.md", "evidence_snippet": "GET \/readme.md HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:46 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /requirements.txt	Élevée	Moyen · 41
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /requirements.txt UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /requirements.txt TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /requirements.txt Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /requirements.txt HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /requirements.txt HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/5 Requête brute (extrait) GET /requirements.txt HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-aliv Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "txt", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "4e3a770701b939530c9cb360d5be82baeb20ee67", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 291, "payload_entropy": 5.441223703029831, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 41, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "e3a0bba1bfcdfa1ed21877cf3d4abccacf722078", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "a30590cdf83cdff2f4fa67dec396b386", "path_pattern_hash": "56e0c068e8a7411ff14802b3183c2a45" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 41 }, "payload_preview": "GET \/requirements.txt HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "method": "GET", "path": "\/requirements.txt", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/requirements.txt HTTP\/1.1", "request_sample": "GET \/requirements.txt HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-aliv", "payload_snippet": "GET \/requirements.txt HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "evidence": { "method": "GET", "path": "\/requirements.txt", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/requirements.txt HTTP\/1.1", "request_sample": "GET \/requirements.txt HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-aliv", "payload_snippet": "GET \/requirements.txt HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "33c5ddde91ab8a7d84d084d0702f24737b292301", "protocol_details": { "http_method": "GET", "http_path": "\/requirements.txt", "request_line": "GET \/requirements.txt HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/requirements.txt HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/requirements.txt", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 41, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 41, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/requirements.txt", "request_line": "GET \/requirements.txt HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/requirements.txt", "evidence_snippet": "GET \/requirements.txt HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:46 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /secrets.yaml	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /secrets.yaml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_k8s_probe Cible HTTP GET /secrets.yaml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /secrets.yaml Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /secrets.yaml HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /secrets.yaml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.3 Requête brute (extrait) GET /secrets.yaml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive U Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yaml", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "bed465ef7b10319d6adf1a5770456b92d16890b0", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 287, "payload_entropy": 5.443337245722938, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "13f00beaba2ee827556c77575380447c81a9ebc2", "event_fingerprint": "4235e92cb860eddcdf70053a1fe2c7501ceda6b0", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "31c418097b361324caadd6cc73ffc492", "path_pattern_hash": "48d0edff0af203e37d12a3776eddc53f" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "method": "GET", "path": "\/secrets.yaml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/secrets.yaml HTTP\/1.1", "request_sample": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "evidence": { "method": "GET", "path": "\/secrets.yaml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/secrets.yaml HTTP\/1.1", "request_sample": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2e80a5ff2f51deb2dd03027a9f5fb8fa122421e8", "protocol_details": { "http_method": "GET", "http_path": "\/secrets.yaml", "request_line": "GET \/secrets.yaml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/secrets.yaml", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/secrets.yaml", "request_line": "GET \/secrets.yaml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/secrets.yaml", "evidence_snippet": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "http_k8s_probe" ] }
13/10/2026 03:19:45 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /staging/	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /staging/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_staging Cible HTTP GET /staging/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /staging/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /staging/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /staging/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (K Requête brute (extrait) GET /staging/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgra Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "6bd24737a4a9e40433fd95210928416b50ddf70c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 283, "payload_entropy": 5.437400118051986, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b88135441c865a0634992c28e0f8c87611e39a17", "event_fingerprint": "1baa0c371d2e04616ab12b54df98ceee3828dbeb", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "596a55148b0322adb74c3ad83d1b8cc6", "path_pattern_hash": "e28322c7662405cdff7b7cbdc2980850" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "method": "GET", "path": "\/staging\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/staging\/ HTTP\/1.1", "request_sample": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgra", "payload_snippet": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "evidence": { "method": "GET", "path": "\/staging\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/staging\/ HTTP\/1.1", "request_sample": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgra", "payload_snippet": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e837f0b3e911510a63d99999e5d0fdb6f82cb738", "protocol_details": { "http_method": "GET", "http_path": "\/staging\/", "request_line": "GET \/staging\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/staging\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/staging\/", "request_line": "GET \/staging\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/staging\/", "evidence_snippet": "GET \/staging\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (K", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_staging" ] }
13/10/2026 03:19:45 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /temp/	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /temp/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /temp/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /temp/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /temp/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /temp/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /temp/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade- Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "4a1b08b1f6d15bc48eb4d5f1efce79d6359fc771", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 280, "payload_entropy": 5.441048140694802, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 49, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7b08deda610021d220859a92fdf15f9daba1ba8c", "event_fingerprint": "13f566dbe9f0f02eeaae765918d39416bae5ac05", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "06431d526dbd5b7626106b5f4fc67c8f", "path_pattern_hash": "edd85d6439d406761e82c4ddc55b2f48" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "method": "GET", "path": "\/temp\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/temp\/ HTTP\/1.1", "request_sample": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "evidence": { "method": "GET", "path": "\/temp\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/temp\/ HTTP\/1.1", "request_sample": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "774c4391b227696262a5b7ff0eea555b1f0bc30d", "protocol_details": { "http_method": "GET", "http_path": "\/temp\/", "request_line": "GET \/temp\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/temp\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/temp\/", "request_line": "GET \/temp\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/temp\/", "evidence_snippet": "GET \/temp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ] }
13/10/2026 03:19:45 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /test/	Élevée	Moyen · 50
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /test/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_test Cible HTTP GET /test/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /test/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /test/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /test/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTM Requête brute (extrait) GET /test/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade- Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "5411388e827eca295edece717228823dd2fe055c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 280, "payload_entropy": 5.430925044780027, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 50, "tag_count": 4, "anomaly_count": 0, "campaign_key": "3bf7e7d1240b6e090a78bdf44f249473a176be5c", "event_fingerprint": "6ff657f3a30a66556571fa6d719d88d17d94c9f5", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "97bd179c1bda97d9b0879acbdb7f9c5d", "path_pattern_hash": "993b890b4d3e33c4356bbad8315b48e6" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "method": "GET", "path": "\/test\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/test\/ HTTP\/1.1", "request_sample": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "evidence": { "method": "GET", "path": "\/test\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/test\/ HTTP\/1.1", "request_sample": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-", "payload_snippet": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "07d329cba10b5517eda31aa862793f15953900b1", "protocol_details": { "http_method": "GET", "http_path": "\/test\/", "request_line": "GET \/test\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/test\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/test\/", "request_line": "GET \/test\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/test\/", "evidence_snippet": "GET \/test\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTM", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_test" ] }
13/10/2026 03:19:45 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /tests/	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /tests/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /tests/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /tests/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /tests/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /tests/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHT Requête brute (extrait) GET /tests/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "cfdb712503e8f204172ad4fa3f50dba6b9d32d9c", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 281, "payload_entropy": 5.430195901175445, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 49, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7b08deda610021d220859a92fdf15f9daba1ba8c", "event_fingerprint": "086a5bc064c32ba2d0bbdea6169dd0457b03c866", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "9c7d760367d8a414a20f578f00eae88a", "path_pattern_hash": "85d97d07b983e825194afd944f439822" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHT", "method": "GET", "path": "\/tests\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/tests\/ HTTP\/1.1", "request_sample": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade", "payload_snippet": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHT", "evidence": { "method": "GET", "path": "\/tests\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/tests\/ HTTP\/1.1", "request_sample": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade", "payload_snippet": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHT", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dadca7368d97d857bda92e95c4faf17a893d50b2", "protocol_details": { "http_method": "GET", "http_path": "\/tests\/", "request_line": "GET \/tests\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHT", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/tests\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/tests\/", "request_line": "GET \/tests\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/tests\/", "evidence_snippet": "GET \/tests\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHT", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ] }
13/10/2026 03:19:45 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /tmp/	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /tmp/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /tmp/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /tmp/ Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /tmp/ HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /tmp/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML Requête brute (extrait) GET /tmp/ HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrade-I Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "251e76217e69e2990a4d7c2ff22e87b96d67bd65", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 279, "payload_entropy": 5.447521541324685, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 84, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 49, "tag_count": 3, "anomaly_count": 0, "campaign_key": "7b08deda610021d220859a92fdf15f9daba1ba8c", "event_fingerprint": "dbc285c93920dd717b2e0414c16c9ec445a12648", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "2a7046d3bdce7b8197fcd0b86abb1d32", "path_pattern_hash": "ac351c7174c8f47a9a9056bd96bcd71c" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "method": "GET", "path": "\/tmp\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/tmp\/ HTTP\/1.1", "request_sample": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-I", "payload_snippet": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "evidence": { "method": "GET", "path": "\/tmp\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/tmp\/ HTTP\/1.1", "request_sample": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrade-I", "payload_snippet": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cfc0bf070c9c226f542bc8af85892f30d81975c9", "protocol_details": { "http_method": "GET", "http_path": "\/tmp\/", "request_line": "GET \/tmp\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/tmp\/", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 84, "classification": 64, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/tmp\/", "request_line": "GET \/tmp\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/tmp\/", "evidence_snippet": "GET \/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ] }
13/10/2026 03:19:45 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /yarn.lock	Élevée	Moyen · 53
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /yarn.lock UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 21 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950517:leak-4 http_probe_yarn Cible HTTP GET /yarn.lock TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /yarn.lock Service HTTP Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 53 Confiance : Confiance 52 % — 3 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /yarn.lock HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-4 Payload (extrait) GET /yarn.lock HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 ( Requête brute (extrait) GET /yarn.lock HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgr Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "lock", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "44a67014f3b33e0afca212fb73d5ee627ed558c7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 284, "payload_entropy": 5.4511315983985025, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 92, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 92, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 53, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a57dedc4db9aa37736997ebc5f29613a177918a5", "event_fingerprint": "d2213bb67d7a9cb05ed95080f82f53a2b3f20bcc", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 92, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "457aa680a8c68b97ec0587792fd28616", "path_pattern_hash": "2c3e7cd1d9a6e7f89c357fd517d36e2a" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 53 }, "payload_preview": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "method": "GET", "path": "\/yarn.lock", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950517:leak-4" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-4" ], "request_line": "GET \/yarn.lock HTTP\/1.1", "request_sample": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "evidence": { "method": "GET", "path": "\/yarn.lock", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3", "950517:leak-4" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-4" ], "request_line": "GET \/yarn.lock HTTP\/1.1", "request_sample": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgr", "payload_snippet": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "94ebe802c9baaca1694f799c22da9c3dc6126576", "protocol_details": { "http_method": "GET", "http_path": "\/yarn.lock", "request_line": "GET \/yarn.lock HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/yarn.lock", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 92, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 53, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 53, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/yarn.lock", "request_line": "GET \/yarn.lock HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/yarn.lock", "evidence_snippet": "GET \/yarn.lock HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "950517:leak-4", "http_probe_yarn" ] }
13/10/2026 03:19:45 UTC	TCP	5173 · HTTP	http	Scan de ports port scan syn · via HTTP:5173 · (reconnaissance) · → /database.sql	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0043 TA0043 Protocole GET /database.sql UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_backup_file_scan http_backup_path Cible HTTP GET /database.sql TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /database.sql Service HTTP Pourquoi cette classification : Sonde fichier sensible / config · confiance 52% Confiance classification 60% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 52 % — 2 tag(s) WAF Signaux Beh Scan Burst Technique MITRE TA0043 Tactiques MITRE TA0043 Ligne de requête `GET /database.sql HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /database.sql HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.3 Requête brute (extrait) GET /database.sql HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive U Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "sql", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "a256b81a49571be3bda096f7ff40f264f6f65ea6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 287, "payload_entropy": 5.443449123534211, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 64, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.7, "risk_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 42, "tag_count": 4, "anomaly_count": 0, "campaign_key": "3fed5f0bf28b95b57a5b5624c8d5a51b74074dd6", "event_fingerprint": "c5b970abebe8cfd4270b289c6d73422d4b0bc34c", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%", "confidence": 0.6, "classification_confidence": 0.6, "precision_score": 62, "precision_signals": [ "INT-beh-scan-burst" ], "kb_rule_ids": [ "INT-beh-scan-burst" ], "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 52, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "0919aeb69ad0ee2e76feb8c2a1e77596", "path_pattern_hash": "5a42560e1122aec9e65ed81031f076c0" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 42 }, "payload_preview": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "method": "GET", "path": "\/database.sql", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/database.sql HTTP\/1.1", "request_sample": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "evidence": { "method": "GET", "path": "\/database.sql", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/database.sql HTTP\/1.1", "request_sample": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%" }, "attack_stage": "recon", "mitre_tactics": [ "TA0043" ], "mitre": "TA0043", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7c5c2cae9d61ba2cb86fbb0937e6d8d4c8f3b285", "protocol_details": { "http_method": "GET", "http_path": "\/database.sql", "request_line": "GET \/database.sql HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/database.sql", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 52%", "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 52%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 60, "confidence_breakdown": { "waf": 60, "classification": 64, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 42, "correlation_boost": 8 }, "attack_stage": "recon", "attack_stage_label": "Reconnaissance", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 42, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-beh-scan-burst" ], "tags_summary_labels_fr": [ "Beh Scan Burst" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0043", "mitre_technique": "TA0043", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/database.sql", "request_line": "GET \/database.sql HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "port scan syn \u00b7 via HTTP:5173 \u00b7 (reconnaissance) \u00b7 \u2192 \/database.sql", "evidence_snippet": "GET \/database.sql HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": true, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "http_backup_file_scan", "http_backup_path" ] }
13/10/2026 03:19:45 UTC	TCP	5173 · HTTP	http	Sonde fichier credential / clé credential file probe · via HTTP:5173 · (tentative d'exploit) · → /credentials.json	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /credentials.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /credentials.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /credentials.json Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF Signaux pat-0472 Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Credentials JSON Ligne de requête `GET /credentials.json HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /credentials.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/5 Requête brute (extrait) GET /credentials.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-aliv Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "52ce12cd9608e2aaf265869963eb9ccc97689fda", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 291, "payload_entropy": 5.437150949147417, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 82, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 52, "tag_count": 2, "anomaly_count": 0, "campaign_key": "0f0c5062b943223ee5f3e5d0419c64ae36c94b90", "event_fingerprint": "1c8f06293a4b492151097c850b76bbdcf258878a", "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 135, "precision_signals": [ "pat-0472", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "pat-0472", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0472" ], "matched_pattern_names": [ "Cred Credentials JSON" ], "pattern_ids": [ "pat-0472" ], "confidence_breakdown": { "waf": 60, "classification": 82, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "lfi_attack", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "f83ce28a0f9c079fc4d356391754c80c", "path_pattern_hash": "2c897236c88b33a0e02927235471c8c3" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 52 }, "payload_preview": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "method": "GET", "path": "\/credentials.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/credentials.json HTTP\/1.1", "request_sample": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-aliv", "payload_snippet": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "evidence": { "method": "GET", "path": "\/credentials.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/credentials.json HTTP\/1.1", "request_sample": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-aliv", "payload_snippet": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "56acbdbc837d54d9e552833879bf02d53948d2eb", "protocol_details": { "http_method": "GET", "http_path": "\/credentials.json", "request_line": "GET \/credentials.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "attack_vector": "credential file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.json", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 60, "classification": 82, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 52, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "pat-0472", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "pat-0472", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/credentials.json", "request_line": "GET \/credentials.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "credential file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/credentials.json", "evidence_snippet": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/5", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:45 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /config/.env.php	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /config/.env.php UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /config/.env.php TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /config/.env.php Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /config/.env.php HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /config/.env.php HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/53 Requête brute (extrait) GET /config/.env.php HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "php", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "54bc453b60497c1fe609887d2d09e4d6b3efcd4e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 290, "payload_entropy": 5.442088132932036, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 7, "anomaly_count": 0, "campaign_key": "06fbd149877a6b1fd4e29feaa9bba2242b3935f0", "event_fingerprint": "3467c54ad3e2b0d74178ef9fdfa247994863061a", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "87ca3f841973cad5d15514ddd19da8f3", "path_pattern_hash": "9033e65212bec8044da5132f26107c7c" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "method": "GET", "path": "\/config\/.env.php", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/config\/.env.php HTTP\/1.1", "request_sample": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "evidence": { "method": "GET", "path": "\/config\/.env.php", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/config\/.env.php HTTP\/1.1", "request_sample": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d4dc5bc8805108219d1cf73892a0d7b58b3caea", "protocol_details": { "http_method": "GET", "http_path": "\/config\/.env.php", "request_line": "GET \/config\/.env.php HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/.env.php", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/config\/.env.php", "request_line": "GET \/config\/.env.php HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/.env.php", "evidence_snippet": "GET \/config\/.env.php HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_probe_config", "http_sensitive_path" ] }
13/10/2026 03:19:44 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /config.json	Élevée	Moyen · 49
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /config.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 http_sensitive_path Cible HTTP GET /config.json TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /config.json Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 100 % — Motif catalogue confirmé · 2 tag(s) WAF Signaux Http Sensitive pat-0247 Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /config.json Ligne de requête `GET /config.json HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /config.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 Requête brute (extrait) GET /config.json HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Up Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "json", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "110dc2bb220538a9df6ea13fd8474a5056c773dc", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 286, "payload_entropy": 5.453490608571425, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 60, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 49, "tag_count": 3, "anomaly_count": 0, "campaign_key": "db20961d1fa8f0ddb629704c4c950530e1d42374", "event_fingerprint": "4725babba9bfc6c41cdc489a4a190e7ef192f2b0", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 182, "precision_signals": [ "INT-http_sensitive", "pat-0247", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "pat-0247", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0247" ], "matched_pattern_names": [ "Probe \/config.json" ], "pattern_ids": [ "pat-0247" ], "confidence_breakdown": { "waf": 60, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "a6d54847dd8275df55eb54698449fe08", "path_pattern_hash": "b2ebf86a95e6e198c8d34ea73388c4ce" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "method": "GET", "path": "\/config.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/config.json HTTP\/1.1", "request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUp", "payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "evidence": { "method": "GET", "path": "\/config.json", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/config.json HTTP\/1.1", "request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUp", "payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "51a8418b7ffdb5f242381184b0f92052cb63c5c7", "protocol_details": { "http_method": "GET", "http_path": "\/config.json", "request_line": "GET \/config.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 60, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "pat-0247", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "pat-0247", "Upstream", "Waf Score" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/config.json", "request_line": "GET \/config.json HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config.json", "evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 2 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3", "http_sensitive_path" ] }
13/10/2026 03:19:44 UTC	TCP	5173 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:5173 · (tentative d'exploit) · → /application.yml	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /application.yml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /application.yml TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /application.yml Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 62 % — 2 tag(s) WAF Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /application.yml HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /application.yml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/53 Requête brute (extrait) GET /application.yml HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "yml", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "b5819b2c14e2e66f80448b9cafafa1033e7b1cec", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 290, "payload_entropy": 5.447141624986297, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 2, "anomaly_count": 0, "campaign_key": "087ae4607c833ec075b265ec598ce3e15884c005", "event_fingerprint": "0d8a4019a7d681ec2841786e1ad46a4eb2d40e9e", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "4c4e70eadeb4f6080f17293caf2c86c0", "path_pattern_hash": "18101755b44cc6d8b270134bcce32edf" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "method": "GET", "path": "\/application.yml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/application.yml HTTP\/1.1", "request_sample": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "evidence": { "method": "GET", "path": "\/application.yml", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/application.yml HTTP\/1.1", "request_sample": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive", "payload_snippet": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e0c27ffa15356be858254c9bd702b9f5a49245bb", "protocol_details": { "http_method": "GET", "http_path": "\/application.yml", "request_line": "GET \/application.yml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "attack_vector": "exploit attempt \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application.yml", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/application.yml", "request_line": "GET \/application.yml HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application.yml", "evidence_snippet": "GET \/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/53", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:44 UTC	TCP	5173 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:5173 · (tentative d'exploit) · → /application.properties	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /application.properties UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /application.properties TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /application.properties Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 62 % — 2 tag(s) WAF Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /application.properties HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /application.properties HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWe Requête brute (extrait) GET /application.properties HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: kee Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "properties", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "e3fd46d86bb2ad69319106117f93875bff130862", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 297, "payload_entropy": 5.407779605972746, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbe9318d9a5885528cf74dfa978c52702b53f920", "event_fingerprint": "8e82b3e15273a50da02b9615e6497414611a5009", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "4ed9f92bd838c5e662eab61663e3453f", "path_pattern_hash": "8c4feac6bcb94afde681db33f96763e3" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWe", "method": "GET", "path": "\/application.properties", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/application.properties HTTP\/1.1", "request_sample": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: kee", "payload_snippet": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWe", "evidence": { "method": "GET", "path": "\/application.properties", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/application.properties HTTP\/1.1", "request_sample": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: kee", "payload_snippet": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWe", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "39f4621574d1bff0d71c84b963ef253ac45f5732", "protocol_details": { "http_method": "GET", "http_path": "\/application.properties", "request_line": "GET \/application.properties HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWe", "attack_vector": "exploit attempt \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application.properties", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/application.properties", "request_line": "GET \/application.properties HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/application.properties", "evidence_snippet": "GET \/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWe", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:44 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /app_dev.php/_profiler/.env	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /app_dev.php/_profiler/.env UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950514:leak-1 Cible HTTP GET /app_dev.php/_profiler/.env TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /app_dev.php/_profiler/.env Service HTTP Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Signaux SIGMA-web-config-leak Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /app_dev.php/_profiler/.env HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-1 Payload (extrait) GET /app_dev.php/_profiler/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) App Requête brute (extrait) GET /app_dev.php/_profiler/.env HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": "env", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "f075b3d401ab9d88b2d00d435895f8b01984fa60", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 301, "payload_entropy": 5.446348486124434, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "af3aa362c32662853f96d0d721a947cdd48711a2", "event_fingerprint": "5b93be83483a9aac7eda7f820ee7eb7520a34eaf", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 215, "precision_signals": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "0e77e4c3ee5711784f96820a071775b5", "path_pattern_hash": "df2bb3033788be83642220993943c1fd" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) App", "method": "GET", "path": "\/app_dev.php\/_profiler\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1", "request_sample": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection:", "payload_snippet": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) App", "evidence": { "method": "GET", "path": "\/app_dev.php\/_profiler\/.env", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-1" ], "request_line": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1", "request_sample": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection:", "payload_snippet": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) App", "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c7d6fefb18145167de9a85da19196ce39ef7ee12", "protocol_details": { "http_method": "GET", "http_path": "\/app_dev.php\/_profiler\/.env", "request_line": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) App", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app_dev.php\/_profiler\/.env", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "SIGMA-web-config-leak", "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "SIGMA-web-config-leak", "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/app_dev.php\/_profiler\/.env", "request_line": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app_dev.php\/_profiler\/.env", "evidence_snippet": "GET \/app_dev.php\/_profiler\/.env HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) App", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950514:leak-1", "http_backup_file_scan", "http_sensitive_path" ] }
13/10/2026 03:19:43 UTC	TCP	5173 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:5173 · (tentative d'exploit) · → /app.log	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /app.log UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 Cible HTTP GET /app.log TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /app.log Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 62 % — 2 tag(s) WAF Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /app.log HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /app.log HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KH Requête brute (extrait) GET /app.log HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive Upgrad Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "log", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "bd1d5b79d00a082701f913befabe9ce3bb41a839", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 282, "payload_entropy": 5.438001694084927, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 60, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 25, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15 }, "risk_score": 43, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b243d053a43c268d0bcb7c329d0b03a0aa8356d9", "event_fingerprint": "a6b53c25742dde715a4ad4652f332ba7c91bc631", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "7dbdd9000aaa1317225e20c848046b5f", "path_pattern_hash": "705676047b0602f87a6c259c895bc0e9" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 43 }, "payload_preview": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KH", "method": "GET", "path": "\/app.log", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/app.log HTTP\/1.1", "request_sample": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrad", "payload_snippet": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KH", "evidence": { "method": "GET", "path": "\/app.log", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/app.log HTTP\/1.1", "request_sample": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nUpgrad", "payload_snippet": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KH", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "defd1a74d8d6c51256d0c8658c4f71926cace534", "protocol_details": { "http_method": "GET", "http_path": "\/app.log", "request_line": "GET \/app.log HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KH", "attack_vector": "exploit attempt \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app.log", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 60, "classification": 72, "behavior": 0, "geo": 0, "protocol": 25, "novelty": 15, "risk_score": 43, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 43, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/app.log", "request_line": "GET \/app.log HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app.log", "evidence_snippet": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KH", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 2 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950470:nosqli-3" ] }
13/10/2026 03:19:43 UTC	TCP	5173 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5173 · (tentative d'exploit) · → /.svn/entries	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /.svn/entries UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537… Émulateur HTTP WAF 27 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950519:leak-6 Cible HTTP GET /.svn/entries TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5173 Chemin / cible /.svn/entries Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) ET .svn entries Probe /.svn/entries Ligne de requête `GET /.svn/entries HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Règles WAF rce-0 nosqli-3 leak-6 Payload (extrait) GET /.svn/entries HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.3 Requête brute (extrait) GET /.svn/entries HTTP/1.1 Host: 62.3.50.33:5173 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36 Accept: / Accept-Language: en-US,en;q=0.5 Connection: keep-alive U Meta JSON brut { "http_header_count": 6, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "svn\/entries", "http_ua_hash": "5e3880436ac6d3a41017662251e08a2a8f9dcc07", "http_host_hash": "4c81e67ae174ff2630ae6942fb4c99c7689f04ec", "http_target_hash": "fec28f2e1aabccf1f7e02d7f5d2dd9dd95703725", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 287, "payload_entropy": 5.4260003856911885, "port_category": "registered", "org": "Feo Prest SRL", "service": "http", "app_proto": "http", "asn": 208137, "country": "DE", "dst_port": 5173, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 6, "anomaly_count": 0, "campaign_key": "bee20cf172489f84ed8936f4b0a9ca1f565ebeb3", "event_fingerprint": "4fca2d972086574f91fe5fe1a941835f1a7e6ece", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0750", "pat-0201" ], "matched_pattern_names": [ "ET .svn entries", "Probe \/.svn\/entries" ], "pattern_ids": [ "pat-0750", "pat-0201" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "DE", "asn": 208137, "org": "Feo Prest SRL", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "dc6af4f1d5992dd2d6962c8241043c36", "payload_hash": "42d85c66869c6fce68f8f5bff9a5c329", "path_pattern_hash": "a8bfcf5717c2407f76d3bb4e6b62379c" }, "target_context": { "dst_port": 5173, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "method": "GET", "path": "\/.svn\/entries", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950519:leak-6" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-6" ], "request_line": "GET \/.svn\/entries HTTP\/1.1", "request_sample": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "evidence": { "method": "GET", "path": "\/.svn\/entries", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950519:leak-6" ], "waf_rule_names": [ "rce-0", "nosqli-3", "leak-6" ], "request_line": "GET \/.svn\/entries HTTP\/1.1", "request_sample": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36\r\nAccept: \/\r\nAccept-Language: en-US,en;q=0.5\r\nConnection: keep-alive\r\nU", "payload_snippet": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c90c4ea88c177989bacd36b116b146c170fdc2b9", "protocol_details": { "http_method": "GET", "http_path": "\/.svn\/entries", "request_line": "GET \/.svn\/entries HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.svn\/entries", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5173, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/.svn\/entries", "request_line": "GET \/.svn\/entries HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/47.0.2526.73 Safari\/537.36", "port": 5173, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5173 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.svn\/entries", "evidence_snippet": "GET \/.svn\/entries HTTP\/1.1\r\nHost: 62.3.50.33:5173\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit\/537.3", "target_port_label": "5173 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5173" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:5173" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950519:leak-6", "http_probe_svn", "http_sensitive_path" ] }

213.209.159.175

Pourquoi listée

Restreindre

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence