Renseignement sur les menaces

États-Unis

23.27.61.29

FAI Ace Data Centers, Inc. Première vue 19/07/2026 05:32 UTC Dernière vue 19/07/2026 05:33 UTC Risque Moyen

Période analysée : 2026-06-19 → 2026-07-19

Activité suspecte — risque 64/100 (Moyen) — MITRE T1083 — confiance 100 % — via HTTP

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 64/100 Moyen

Première observation 19/07/2026 05:32 UTC

Dernière observation 19/07/2026 05:33 UTC

Événements (période) 6

MITRE ATT&CK principal T1083 3 occurrences

Activité suspecte — risque 64/100 (Moyen) — MITRE T1083 — confiance 100 % — via HTTP

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%

Confiance 100 % — Score WAF 100 · 6 tag(s) WAF

Comparaison ASN / FAI

ASN 11798 · 23.27.61.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 6 événements sur la période pour cette IP.

136.0.156.225 Sonde TLS 19/07/2026 15:09 UTC
142.111.33.65 Cross-site scripting 19/07/2026 14:45 UTC
23.27.90.41 Cross-site scripting 19/07/2026 08:01 UTC
142.111.63.47 neo4j probe 18/07/2026 23:39 UTC
23.27.74.199 Cross-site scripting 18/07/2026 22:38 UTC
142.111.59.230 Cross-site scripting 18/07/2026 22:05 UTC
136.0.27.108 couchdb probe 18/07/2026 21:46 UTC
23.27.94.2 neo4j probe 18/07/2026 18:57 UTC

Événements (filtres)

Première observation

19/07/2026 05:32 UTC

Dernière observation

19/07/2026 05:33 UTC

Dernière activité (filtres)

19/07/2026 05:33 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Ace Data Centers, Inc. 0 Port 5601 xss_attack

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

config file probe · via HTTP:5601 · (tentative d'exploit) · → /api/console/proxy

Détails protocole

Méthode: POST
Chemin: /api/console/proxy
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 S…

Aperçu payload

POST /api/console/proxy?path=_search&method=POST HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6

Port / service

5601 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — 6 tag(s) WAF

Technique MITRE

T1083

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

Http Sensitive Upstream Waf Score

Confiance

100%

Famille de menace

path_traversal config_leak_scan

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

6 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

6 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
19/07/2026 05:33:12 UTC	TCP	5601 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5601 · (tentative d'exploit) · → /api/console/proxy	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole POST /api/console/proxy UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 35 Recommandation Investiguer Tags 950325:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP POST /api/console/proxy TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 5601 Chemin / cible /api/console/proxy Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 6 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/console/proxy?path=_search&method=POST HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-api webshell-param-file Payload (extrait) POST /api/console/proxy?path=_search&method=POST HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6 Requête brute (extrait) POST /api/console/proxy?path=_search&method=POST HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Content-Length: 212 Accept: / Accept-Encoding Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "http_header_count": 14, "http_query_params": 2, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533", "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c", "http_target_hash": "bd77752abd24d5185331e17af0baa7bbcaf39172", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 775, "payload_entropy": 5.559434364644313, "port_category": "registered", "org": "Ace Data Centers, Inc.", "service": "http", "app_proto": "http", "asn": 11798, "country": "US", "dst_port": 5601, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 10, "anomaly_count": 0, "campaign_key": "7fd9345c830deaf3c58799c199c5674a9c56b144", "event_fingerprint": "a70eeed4cf1cde2181a050dabb90fd74798d5104", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 11798, "org": "Ace Data Centers, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3", "payload_hash": "b0be7ff05938e7f6684e7b95546d90f4", "path_pattern_hash": "2257749ad5213b22dc528ffa1cca7545" }, "target_context": { "dst_port": 5601, "service": "http", "service_name": "http", "risk_score": 64 }, "method": "POST", "path": "\/api\/console\/proxy", "query_string": "path=_search&method=POST", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "webshell-param-file" ], "request_line": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1", "payload_snippet": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "evidence": { "method": "POST", "path": "\/api\/console\/proxy", "query_string": "path=_search&method=POST", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "webshell-param-file" ], "request_line": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1", "request_sample": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nContent-Length: 212\r\nAccept: \/\r\nAccept-Encoding", "payload_snippet": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b2f076d3e8fe7f226fa53b27f7d7b8d98f3661d1", "protocol_details": { "http_method": "POST", "http_path": "\/api\/console\/proxy", "request_line": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/api\/console\/proxy", "request_line": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy", "evidence_snippet": "POST \/api\/console\/proxy?path=_search&method=POST HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file", "http_probe_api", "http_sensitive_path", "http_suspicious_params", "net_web_probe" ] }
19/07/2026 05:33:09 UTC	TCP	5601 · HTTP	http	probe api probe api · via HTTP:5601 · (sonde / probe) · → /api/saved_objects/_find	Élevée	Moyen · 55
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole GET /api/saved_objects/_find UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 34 Recommandation Investiguer Tags 950325:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /api/saved_objects/_find TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5601 Chemin / cible /api/saved_objects/_find Service HTTP Pourquoi cette classification : Type « probe_api » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 55 Confiance : Confiance 50 % — 6 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `GET /api/saved_objects/_find?type=search&per_page=100 HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Règles WAF rce-0 nosqli-3 k8s-api kibana-saved-objects Payload (extrait) GET /api/saved_objects/_find?type=search&per_page=100 HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Requête brute (extrait) GET /api/saved_objects/_find?type=search&per_page=100 HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept: text/html,application/ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "http_header_count": 12, "http_query_params": 2, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858", "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c", "http_target_hash": "5951cdb09bce1183e1d22cf0285c67ee7fe40097", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 634, "payload_entropy": 5.5986388615461555, "port_category": "registered", "org": "Ace Data Centers, Inc.", "service": "http", "app_proto": "http", "asn": 11798, "country": "US", "dst_port": 5601, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 55, "tag_count": 8, "anomaly_count": 0, "campaign_key": "ca612aa692305b02628f9116c1cd8166c745daad", "event_fingerprint": "783bfaf85666a8b210af5a1f04b11d7fe26ff7f3", "classification_reason": "Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 55 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 11798, "org": "Ace Data Centers, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee", "payload_hash": "9010cb61a7472f6a71c320de6ee600b8", "path_pattern_hash": "70a8645f84cff7df8c80fa46abb163ff" }, "target_context": { "dst_port": 5601, "service": "http", "service_name": "http", "risk_score": 55 }, "payload_preview": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "method": "GET", "path": "\/api\/saved_objects\/_find", "query_string": "type=search&per_page=100", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950609:kibana-saved-objects" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "kibana-saved-objects" ], "request_line": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1", "request_sample": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept: text\/html,application\/", "payload_snippet": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "evidence": { "method": "GET", "path": "\/api\/saved_objects\/_find", "query_string": "type=search&per_page=100", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950609:kibana-saved-objects" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "kibana-saved-objects" ], "request_line": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1", "request_sample": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept: text\/html,application\/", "payload_snippet": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "classification_reason": "Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "86e52d1d131510dca392080a53d2ba46ab30cc39", "protocol_details": { "http_method": "GET", "http_path": "\/api\/saved_objects\/_find", "request_line": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "attack_vector": "probe api \u00b7 via HTTP:5601 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/saved_objects\/_find", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 50 % \u2014 via HTTP", "confidence_pct": 50, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 55 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 55, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "http_method": "GET", "http_path": "\/api\/saved_objects\/_find", "request_line": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "probe api \u00b7 via HTTP:5601 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/saved_objects\/_find", "evidence_snippet": "GET \/api\/saved_objects\/_find?type=search&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 6 tag(s) WAF", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950609:kibana-saved-objects", "http_probe_api", "net_web_probe" ] }
19/07/2026 05:33:06 UTC	TCP	5601 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5601 · (tentative d'exploit) · → /api/console/proxy	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /api/console/proxy UA Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 35 Recommandation Investiguer Tags 950325:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /api/console/proxy TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5601 Chemin / cible /api/console/proxy Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 6 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 ES cat indices Ligne de requête `GET /api/console/proxy?path=_cat/indices&method=GET HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Règles WAF rce-0 nosqli-3 k8s-api webshell-param-file Payload (extrait) GET /api/console/proxy?path=_cat/indices&method=GET HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (X11; Linux x86_64; Requête brute (extrait) GET /api/console/proxy?path=_cat/indices&method=GET HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/ Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "http_header_count": 9, "http_query_params": 2, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "61a68d8ae82bc8425114abf48390d06cae6524df", "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c", "http_target_hash": "f07df4be4984e2d1affe162d58bbf9a02850d0e5", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 445, "payload_entropy": 5.444425754901784, "port_category": "registered", "org": "Ace Data Centers, Inc.", "service": "http", "app_proto": "http", "asn": 11798, "country": "US", "dst_port": 5601, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.4, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 10, "anomaly_count": 0, "campaign_key": "7fd9345c830deaf3c58799c199c5674a9c56b144", "event_fingerprint": "c0c7c6e2c8eda6df4bf00848f645c8d40cb7ec2d", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284", "pat-0342" ], "matched_pattern_names": [ "CRS 941130", "ES cat indices" ], "pattern_ids": [ "pat-0284", "pat-0342" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 11798, "org": "Ace Data Centers, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1846ec21f37e27db5dcc081ead338b2b", "payload_hash": "754a201dbfebac490d45f021be7820e9", "path_pattern_hash": "2257749ad5213b22dc528ffa1cca7545" }, "target_context": { "dst_port": 5601, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;", "method": "GET", "path": "\/api\/console\/proxy", "query_string": "path=_cat\/indices&method=GET", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "webshell-param-file" ], "request_line": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1", "request_sample": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/", "payload_snippet": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;", "evidence": { "method": "GET", "path": "\/api\/console\/proxy", "query_string": "path=_cat\/indices&method=GET", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "webshell-param-file" ], "request_line": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1", "request_sample": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,\/", "payload_snippet": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9e3d5bd8c6fb42c04200d29f343809108d8efe55", "protocol_details": { "http_method": "GET", "http_path": "\/api\/console\/proxy", "request_line": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;", "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/console\/proxy", "request_line": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:135.0) Gecko\/20100101 Firefox\/135.0", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/console\/proxy", "evidence_snippet": "GET \/api\/console\/proxy?path=_cat\/indices&method=GET HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64;", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950630:webshell-param-file", "http_probe_api", "http_sensitive_path", "http_suspicious_params", "net_web_probe" ] }
19/07/2026 05:33:03 UTC	TCP	5601 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:5601 · (tentative d'exploit) · → /api/kibana/settings	Élevée	Moyen · 63
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /api/kibana/settings UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 23 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950600:k8s-api Cible HTTP GET /api/kibana/settings TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5601 Chemin / cible /api/kibana/settings Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 63 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /api/kibana/settings HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/kibana/settings HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. Requête brute (extrait) GET /api/kibana/settings HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif, Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c", "http_target_hash": "9fd3c71dc599161a91a895ce45baf35b39d347d2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 589, "payload_entropy": 5.553102348548008, "port_category": "registered", "org": "Ace Data Centers, Inc.", "service": "http", "app_proto": "http", "asn": 11798, "country": "US", "dst_port": 5601, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 63, "tag_count": 7, "anomaly_count": 0, "campaign_key": "43b41f5f89323161ef01fa4e75b30473783fd816", "event_fingerprint": "35b94aec48152722d57071ece9ed7045fa586824", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 63 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 11798, "org": "Ace Data Centers, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "a8ff265582a5f5d46d8f98a560cd78b0", "path_pattern_hash": "4809187df9ef80bfa036937ba9c0de03" }, "target_context": { "dst_port": 5601, "service": "http", "service_name": "http", "risk_score": 63 }, "payload_preview": "GET \/api\/kibana\/settings HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.", "method": "GET", "path": "\/api\/kibana\/settings", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/kibana\/settings HTTP\/1.1", "request_sample": "GET \/api\/kibana\/settings HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,", "payload_snippet": "GET \/api\/kibana\/settings HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.", "evidence": { "method": "GET", "path": "\/api\/kibana\/settings", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/kibana\/settings HTTP\/1.1", "request_sample": "GET \/api\/kibana\/settings HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,", "payload_snippet": "GET \/api\/kibana\/settings HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2bacd1fa577f4aee2ddc5f563307b75e2e33e52e", "protocol_details": { "http_method": "GET", "http_path": "\/api\/kibana\/settings", "request_line": "GET \/api\/kibana\/settings HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/kibana\/settings HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.", "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/kibana\/settings", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 63 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 63, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/kibana\/settings", "request_line": "GET \/api\/kibana\/settings HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/kibana\/settings", "evidence_snippet": "GET \/api\/kibana\/settings HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "http_probe_api", "http_sensitive_path", "net_web_probe" ] }
19/07/2026 05:33:00 UTC	TCP	5601 · HTTP	http	Cross-site scripting xss attack · via HTTP:5601 · (tentative d'exploit) · → /api/saved_objects/_find	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /api/saved_objects/_find UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 34 Recommandation Investiguer Tags 950325:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /api/saved_objects/_find TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5601 Chemin / cible /api/saved_objects/_find Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 57 Confiance : Confiance 59 % — Motif catalogue confirmé · 6 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /api/saved_objects/_find?type=index-pattern&per_page=100 HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-api kibana-saved-objects Payload (extrait) GET /api/saved_objects/_find?type=index-pattern&per_page=100 HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows N Requête brute (extrait) GET /api/saved_objects/_find?type=index-pattern&per_page=100 HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+x Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "http_header_count": 12, "http_query_params": 2, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "539ecdad151c9c9dc71f317e9e2fbae4aee81334", "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c", "http_target_hash": "41750dd97e9203cca7e50e204ac9bb03f61dcfc3", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 625, "payload_entropy": 5.580360509252337, "port_category": "registered", "org": "Ace Data Centers, Inc.", "service": "http", "app_proto": "http", "asn": 11798, "country": "US", "dst_port": 5601, "risk_waf": 100, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 100, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 57, "tag_count": 8, "anomaly_count": 0, "campaign_key": "ca612aa692305b02628f9116c1cd8166c745daad", "event_fingerprint": "144a52a97259f71c4c666881432f3cff9dc39f37", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 11798, "org": "Ace Data Centers, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "df9c14bed57e6bde007625ceaa20e44f", "payload_hash": "7344c9148a1b36d53a70afbd10a01c42", "path_pattern_hash": "70a8645f84cff7df8c80fa46abb163ff" }, "target_context": { "dst_port": 5601, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows N", "method": "GET", "path": "\/api\/saved_objects\/_find", "query_string": "type=index-pattern&per_page=100", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950609:kibana-saved-objects" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "kibana-saved-objects" ], "request_line": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1", "request_sample": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+x", "payload_snippet": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows N", "evidence": { "method": "GET", "path": "\/api\/saved_objects\/_find", "query_string": "type=index-pattern&per_page=100", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "waf_tags": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950609:kibana-saved-objects" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api", "kibana-saved-objects" ], "request_line": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1", "request_sample": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+x", "payload_snippet": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows N", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a22b94add683c5ab146fe3112146ee642703b4ec", "protocol_details": { "http_method": "GET", "http_path": "\/api\/saved_objects\/_find", "request_line": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows N", "attack_vector": "xss attack \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/saved_objects\/_find", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 100, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/saved_objects\/_find", "request_line": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/135.0.0.0 Safari\/537.36", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/saved_objects\/_find", "evidence_snippet": "GET \/api\/saved_objects\/_find?type=index-pattern&per_page=100 HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Windows N", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950325:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "950609:kibana-saved-objects", "http_probe_api", "net_web_probe" ] }
19/07/2026 05:32:57 UTC	TCP	5601 · HTTP	http	Cross-site scripting xss attack · via HTTP:5601 · (tentative d'exploit) · → /api/status	Élevée	Moyen · 57
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole GET /api/status UA Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36… Émulateur HTTP WAF 23 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950600:k8s-api Cible HTTP GET /api/status TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5601 Chemin / cible /api/status Service HTTP Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 57 Confiance : Confiance 59 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 Ligne de requête `GET /api/status HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/status HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KH Requête brute (extrait) GET /api/status HTTP/1.1 Host: 62.3.50.33:5601 User-Agent: Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322", "emulator_response_len": 163, "http_header_count": 12, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "fbc0a46f9c2e144fc770fef4de21ffe725652a28", "http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c", "http_target_hash": "7fbc29f027b400f6512972fd492109517e235ed4", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 591, "payload_entropy": 5.5402993139918175, "port_category": "registered", "org": "Ace Data Centers, Inc.", "service": "http", "app_proto": "http", "asn": 11798, "country": "US", "dst_port": 5601, "risk_waf": 100, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 100, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 57, "tag_count": 6, "anomaly_count": 0, "campaign_key": "59eb7b692d13ad334aed59d05b7e566aa16a5090", "event_fingerprint": "250e2065f3e1c173372f05dd39ab0ee341825b3b", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 100, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 57 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 11798, "org": "Ace Data Centers, Inc.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "6273f9be1b02ca05f8b0ec5ce5b17279", "payload_hash": "511a1ba1c6d095a68db2c075ddcc36d2", "path_pattern_hash": "0ea44bf547cfd3e93a42dabfc2f1808a" }, "target_context": { "dst_port": 5601, "service": "http", "service_name": "http", "risk_score": 57 }, "payload_preview": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KH", "method": "GET", "path": "\/api\/status", "user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/status HTTP\/1.1", "request_sample": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif", "payload_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KH", "evidence": { "method": "GET", "path": "\/api\/status", "user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api" ], "waf_rule_names": [ "rce-0", "nosqli-3", "k8s-api" ], "request_line": "GET \/api\/status HTTP\/1.1", "request_sample": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif", "payload_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KH", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d280ea03ced3bba1aa1ce2ef9e9a25750d79e7ab", "protocol_details": { "http_method": "GET", "http_path": "\/api\/status", "request_line": "GET \/api\/status HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.\u2026", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KH", "attack_vector": "xss attack \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/status", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP", "confidence_pct": 59, "confidence_breakdown": { "waf": 100, "classification": 68, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 57 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 57, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5601, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/api\/status", "request_line": "GET \/api\/status HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Mobile Safari\/537.\u2026", "port": 5601, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "xss attack \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/status", "evidence_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit\/537.36 (KH", "target_port_label": "5601 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5601" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "950600:k8s-api", "http_probe_api", "net_web_probe" ] }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

23.27.61.29

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

23.27.61.29

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence