15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid.js
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid.js UA Mozilla/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build/FROYO…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid.js HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid.js HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build/FROYO) A
Requête brute (extrait)
GET /sendgrid.js HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "ef7ee2a2c7d300eda4e96e0f837c5648d5702c64",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "af3d72bf73a37ea591ef956266b665cf12d6558b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 265,
"payload_entropy": 5.438620609458386,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "da0e92cd0ebb085b51990a0223f84b28a1dbd99e",
"event_fingerprint": "62399de7ef9ff0eebfad0df08dac60d58dfd29f2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "df02e92450948a890d4905ca174df839",
"payload_hash": "ec0be5d2a62b6ec975dbda8e180e1b3d",
"path_pattern_hash": "f692cb581dcfe0e04c53a5afcbe187bf"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) A",
"method": "GET",
"path": "\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
"payload_snippet": "GET \/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) A",
"evidence": {
"method": "GET",
"path": "\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/533.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
"payload_snippet": "GET \/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) A",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "90799669ded77127a530d746d128f368c5b1d140",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.js",
"request_line": "GET \/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobi\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) A",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.js",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.js",
"request_line": "GET \/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) AppleWebKit\/533.1 (KHTML, like Gecko) Version\/4.0 Mobi\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.js",
"evidence_snippet": "GET \/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.2; en-us; SCH-I800 Build\/FROYO) A",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /backend/sendgrid.js
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/sendgrid.js UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/backend/sendgrid.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/sendgrid.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/sendgrid.js HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.186 Safari/535.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/sendgrid.js HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit
Requête brute (extrait)
GET /backend/sendgrid.js HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.186 Safari/535.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "2812e13e86f1b79c9183682e95e7282e60daef11",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "7780371ee1da1efa0a933ac9cc0a62e8162ae0b1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 256,
"payload_entropy": 5.402739371761643,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "753afb1918d6137db233529f8ee584620383746e",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0058a2ac699769c7006f3c5769e73a54",
"payload_hash": "b94c31fa23fab11f965d9e7ed7bcf588",
"path_pattern_hash": "6b7d9f0363df4f0d6ef22b0d50871ee8"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit",
"method": "GET",
"path": "\/backend\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.186 Safari\/535.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.186 Safari\/535.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/backend\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.186 Safari\/535.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.186 Safari\/535.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab4b3895ed7a76848440eba79c525035ea840374",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/sendgrid.js",
"request_line": "GET \/backend\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.186 Safari\/535.1",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/sendgrid.js",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/sendgrid.js",
"request_line": "GET \/backend\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit\/535.1 (KHTML, like Gecko) Chrome\/14.0.835.186 Safari\/535.1",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/sendgrid.js",
"evidence_snippet": "GET \/backend\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /config/sendgrid.js
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/sendgrid.js UA Mozilla/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit/537.42 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/sendgrid.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/config/sendgrid.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/sendgrid.js HTTP/1.1
User-Agent
Mozilla/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit/537.42 (KHTML, like Gecko) Chromium/25.0.1349.2 Chrome/25.0.1349.2 Safari/537.42
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/sendgrid.js HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit/537.4
Requête brute (extrait)
GET /config/sendgrid.js HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit/537.42 (KHTML, like Gecko) Chromium/25.0.1349.2 Chrome/25.0.1349.2 Safari/537.42 Accept-Charset: utf-8 Accept-Encoding: gzip Conne
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "ac295833e861e41336cc6a78bae3e3d38557f557",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "dfc017b1f5d967c2ea8d62566bf7510e84bb5637",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 272,
"payload_entropy": 5.49900446151563,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "992c1bc2756564399d784e062f57d533de4c961d",
"event_fingerprint": "6467e203ad2e1041aea442f9e4e09e7d71d551e4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a8c2627984e0624773e0f0c1a9d592e8",
"payload_hash": "a2027035a2c0557048be83b4050ca170",
"path_pattern_hash": "cf64c655ed198e8031863155489c92f2"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/config\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.4",
"method": "GET",
"path": "\/config\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.42 (KHTML, like Gecko) Chromium\/25.0.1349.2 Chrome\/25.0.1349.2 Safari\/537.42",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.42 (KHTML, like Gecko) Chromium\/25.0.1349.2 Chrome\/25.0.1349.2 Safari\/537.42\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConne",
"payload_snippet": "GET \/config\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.4",
"evidence": {
"method": "GET",
"path": "\/config\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.42 (KHTML, like Gecko) Chromium\/25.0.1349.2 Chrome\/25.0.1349.2 Safari\/537.42",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.42 (KHTML, like Gecko) Chromium\/25.0.1349.2 Chrome\/25.0.1349.2 Safari\/537.42\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConne",
"payload_snippet": "GET \/config\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ec4ed5804240302cec29810490075508d1d30db7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.js",
"request_line": "GET \/config\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.42 (KHTML, like Gecko) Chromium\/25.0.1349.2 Chrome\/25.0.1349.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.4",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.js",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.js",
"request_line": "GET \/config\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.42 (KHTML, like Gecko) Chromium\/25.0.1349.2 Chrome\/25.0.1349.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.js",
"evidence_snippet": "GET \/config\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SMART-TV; X11; Linux armv7l) AppleWebkit\/537.4",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid.min.js
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid.min.js UA Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us)…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid.min.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid.min.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid.min.js HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit/525.18.1 (KHTML, like Gecko) Version/3.1.1 Mobile/5A347 Safari/525.200
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid.min.js HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us
Requête brute (extrait)
GET /sendgrid.min.js HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit/525.18.1 (KHTML, like Gecko) Version/3.1.1 Mobile/5A347 Safari/525.200 Accept-Charset: utf-8 Accept-Encoding: gz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "js",
"http_ua_hash": "6d10ed516e2c23ca8f7bde0be44e14eb0b92730a",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "c3c746112c0f0239b9db723ddc097884068a0409",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 281,
"payload_entropy": 5.380083762854639,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "da0e92cd0ebb085b51990a0223f84b28a1dbd99e",
"event_fingerprint": "8d6a6c43fc71cd1b6f8f3e8c66010f8aacef4676",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7523c5d32d67d6334420581b77fccf10",
"payload_hash": "396da6b4047599b7f78e46aa196b45fb",
"path_pattern_hash": "eedccc9bc850fd543465f59f02102b9c"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us",
"method": "GET",
"path": "\/sendgrid.min.js",
"user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.min.js HTTP\/1.1",
"request_sample": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gz",
"payload_snippet": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us",
"evidence": {
"method": "GET",
"path": "\/sendgrid.min.js",
"user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.min.js HTTP\/1.1",
"request_sample": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gz",
"payload_snippet": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "43d3fb083919a293abbe1ff806da8f808b03a458",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.min.js",
"request_line": "GET \/sendgrid.min.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 \u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.min.js",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.min.js",
"request_line": "GET \/sendgrid.min.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 \u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.min.js",
"evidence_snippet": "GET \/sendgrid.min.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid_helper.py
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid_helper.py UA Mozilla/5.0 (MeeGo; NokiaN950-00/00) AppleWebKit/534.13 (KHTML,…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid_helper.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid_helper.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid_helper.py HTTP/1.1
User-Agent
Mozilla/5.0 (MeeGo; NokiaN950-00/00) AppleWebKit/534.13 (KHTML, like Gecko) NokiaBrowser/8.5.0 Mobile Safari/534.13
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid_helper.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (MeeGo; NokiaN950-00/00) AppleWebKit/534.13 (KH
Requête brute (extrait)
GET /sendgrid_helper.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (MeeGo; NokiaN950-00/00) AppleWebKit/534.13 (KHTML, like Gecko) NokiaBrowser/8.5.0 Mobile Safari/534.13 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "py",
"http_ua_hash": "24b8ae7e550e8f1fa3b279857f9041f923b8c173",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "772198c723c64c6ab2c19442e512e9b63957a609",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 253,
"payload_entropy": 5.368155318090521,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 67,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1611a821b1cea7ed6aed3693e3ca2c41d5838222",
"event_fingerprint": "cd8e8d0dbca7f58bf4340b962b495af900043b56",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 67,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8023f80db0137313b234a5b9a095d867",
"payload_hash": "626c2312700642ed35a7b06c3e5f0552",
"path_pattern_hash": "f0a726c4ecbb7f24a7410bc2568f13fc"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/sendgrid_helper.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KH",
"method": "GET",
"path": "\/sendgrid_helper.py",
"user_agent": "Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid_helper.py HTTP\/1.1",
"request_sample": "GET \/sendgrid_helper.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid_helper.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KH",
"evidence": {
"method": "GET",
"path": "\/sendgrid_helper.py",
"user_agent": "Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid_helper.py HTTP\/1.1",
"request_sample": "GET \/sendgrid_helper.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid_helper.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KH",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7398908649ba9571a3bbe3f10704f5b7b7208c1e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid_helper.py",
"request_line": "GET \/sendgrid_helper.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid_helper.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KH",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid_helper.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 67,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid_helper.py",
"request_line": "GET \/sendgrid_helper.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KHTML, like Gecko) NokiaBrowser\/8.5.0 Mobile Safari\/534.13",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid_helper.py",
"evidence_snippet": "GET \/sendgrid_helper.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (MeeGo; NokiaN950-00\/00) AppleWebKit\/534.13 (KH",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /src/sendgrid.js
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/sendgrid.js UA Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/src/sendgrid.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/src/sendgrid.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/sendgrid.js HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /src/sendgrid.js HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (K
Requête brute (extrait)
GET /src/sendgrid.js HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "9f44694db042382b1894b9467bda9cec0203a128",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "a3238471d1a50dc88710b61abe1ecef20adb8ca4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 256,
"payload_entropy": 5.3708289392557305,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "9be6a2e08eb1ecaca63a6a02e654ae86b67dc092",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "dfad63a0b311a8b1ad2a0387ee24907c",
"payload_hash": "ab2f180c4d345be49ca95b5f4ac1c907",
"path_pattern_hash": "e36285cd7734c4bd56f4ea4e4d82c8ca"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/src\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (K",
"method": "GET",
"path": "\/src\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/src\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (K",
"evidence": {
"method": "GET",
"path": "\/src\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/src\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (K",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a139a05e5bf39b30c950b903f7be5b249b29381a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/sendgrid.js",
"request_line": "GET \/src\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (K",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/sendgrid.js",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/sendgrid.js",
"request_line": "GET \/src\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/sendgrid.js",
"evidence_snippet": "GET \/src\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; Pixel 3) AppleWebKit\/537.36 (K",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8300 · (tentative d'exploit) · → /server.pem
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /server.pem UA Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950086:sqli-21
950326:rce-0
950470:nosqli-3
http_sensitive_path
Cible HTTP
GET
/server.pem
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/server.pem
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « sqli-21 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0498
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Server PEM certificate
Ligne de requête
GET /server.pem HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15G77 MicroMessenger/7.0.3(0x17000321) NetType/WIFI Language/zh_CN
Règles WAF
sqli-21
rce-0
nosqli-3
Payload (extrait)
GET /server.pem HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKi
Requête brute (extrait)
GET /server.pem HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15G77 MicroMessenger/7.0.3(0x17000321) NetType/WIFI Language/zh_CN Accept-Charset: utf-8
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "pem",
"http_ua_hash": "4bb4290188685f5033767113f92b3972ed7795d9",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "5fe380198269c9a1a6d0511e7b302de05ee3b072",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 301,
"payload_entropy": 5.460427462028501,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 88,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 88,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "42dc425920cc8dca99446dd442976f38bc744b2d",
"event_fingerprint": "8086959cbe6d00b941b31fbf4c35ff2a2c23b864",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0498",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0498",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0498"
],
"matched_pattern_names": [
"Cred Server PEM certificate"
],
"pattern_ids": [
"pat-0498"
],
"confidence_breakdown": {
"waf": 88,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "32be96c38f74d9e299607618d54e6b44",
"payload_hash": "b1765e3c4ccb3574a18f96e4720f2b31",
"path_pattern_hash": "6d08c40a9dd5a1c7d52ff80a12d01067"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/server.pem HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKi",
"method": "GET",
"path": "\/server.pem",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Mobile\/15G77 MicroMessenger\/7.0.3(0x17000321) NetType\/WIFI Language\/zh_CN",
"waf_tags": [
"950086:sqli-21",
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"sqli-21",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server.pem HTTP\/1.1",
"request_sample": "GET \/server.pem HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Mobile\/15G77 MicroMessenger\/7.0.3(0x17000321) NetType\/WIFI Language\/zh_CN\r\nAccept-Charset: utf-8\r",
"payload_snippet": "GET \/server.pem HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/server.pem",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Mobile\/15G77 MicroMessenger\/7.0.3(0x17000321) NetType\/WIFI Language\/zh_CN",
"waf_tags": [
"950086:sqli-21",
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"sqli-21",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server.pem HTTP\/1.1",
"request_sample": "GET \/server.pem HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Mobile\/15G77 MicroMessenger\/7.0.3(0x17000321) NetType\/WIFI Language\/zh_CN\r\nAccept-Charset: utf-8\r",
"payload_snippet": "GET \/server.pem HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKi",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bf77aa465c691284a51c06a89c358a340e650b0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server.pem",
"request_line": "GET \/server.pem HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Mobile\/15G77 MicroMes\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server.pem HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKi",
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server.pem",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"pat-0498",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0498",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server.pem",
"request_line": "GET \/server.pem HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) Mobile\/15G77 MicroMes\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server.pem",
"evidence_snippet": "GET \/server.pem HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKi",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950086:sqli-21",
"950326:rce-0",
"950470:nosqli-3",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid_config.py
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid_config.py UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid_config.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid_config.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid_config.py HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240&Win32
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid_config.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3
Requête brute (extrait)
GET /sendgrid_config.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240&Win32 Accept-Charset: utf-8 Accept-Encoding: gzip Conn
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "py",
"http_ua_hash": "b0364640299db33f8404b11696d99381bae30e58",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "a8a91d2a8a844789d248ad7ec78ac7f9ab48d8a3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 273,
"payload_entropy": 5.430834042627917,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "da0e92cd0ebb085b51990a0223f84b28a1dbd99e",
"event_fingerprint": "66188291b9a2eb903010cfca4e518e87fda91242",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7236346f5c04ebdd8f79152ee3fb55b6",
"payload_hash": "35a3741d0dc4a92140926c223053840e",
"path_pattern_hash": "5188a9e48f153fb145fe03b080df78ed"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/sendgrid_config.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"method": "GET",
"path": "\/sendgrid_config.py",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.135 Safari\/537.36 Edge\/12.10240&Win32",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid_config.py HTTP\/1.1",
"request_sample": "GET \/sendgrid_config.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.135 Safari\/537.36 Edge\/12.10240&Win32\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
"payload_snippet": "GET \/sendgrid_config.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/sendgrid_config.py",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.135 Safari\/537.36 Edge\/12.10240&Win32",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid_config.py HTTP\/1.1",
"request_sample": "GET \/sendgrid_config.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.135 Safari\/537.36 Edge\/12.10240&Win32\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
"payload_snippet": "GET \/sendgrid_config.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9443a0026205358d6f79501efb914d6ea74194ec",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid_config.py",
"request_line": "GET \/sendgrid_config.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.135 Safari\/537.36 Edg\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid_config.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid_config.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid_config.py",
"request_line": "GET \/sendgrid_config.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/42.0.2311.135 Safari\/537.36 Edg\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid_config.py",
"evidence_snippet": "GET \/sendgrid_config.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /static/js/sendgrid.js
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /static/js/sendgrid.js UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/static/js/sendgrid.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/static/js/sendgrid.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /static/js/sendgrid.js HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /static/js/sendgrid.js HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTM
Requête brute (extrait)
GET /static/js/sendgrid.js HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "js",
"http_ua_hash": "9c4bdd75e2ca4903006c641a6c928c45c459916f",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "ddd3a9b3f48c6bae364c57b22089cf14b8553bb8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 246,
"payload_entropy": 5.425856400877069,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 70,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "a54f23919201c8d683dd4e1d96c0ef50b7a24ea1",
"event_fingerprint": "8e9e7e8f7e02cea4aabefd9583155d280ffaa3df",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "040ee0f70e9e711007ced7259d0b5a88",
"payload_hash": "568cfa658d08d0930845b033c2e2a322",
"path_pattern_hash": "93094bc722813d7455c7ed98cc68fdb3"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/static\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"method": "GET",
"path": "\/static\/js\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.102 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/static\/js\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/static\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.102 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/static\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"evidence": {
"method": "GET",
"path": "\/static\/js\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.102 Safari\/537.36",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/static\/js\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/static\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.102 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/static\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dfbb3fb8ca96942c0407630458adb4213dfade16",
"protocol_details": {
"http_method": "GET",
"http_path": "\/static\/js\/sendgrid.js",
"request_line": "GET \/static\/js\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.102 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/static\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/js\/sendgrid.js",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/static\/js\/sendgrid.js",
"request_line": "GET \/static\/js\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/70.0.3538.102 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/static\/js\/sendgrid.js",
"evidence_snippet": "GET \/static\/js\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTM",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_static",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8300 · (tentative d'exploit) · → /.ssh/authorized_keys
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /.ssh/authorized_keys UA Mozilla/5.0 (Linux; Android 9; JSN-AL00a Build/HONORJSN-AL00a; …
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950086:sqli-21
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/.ssh/authorized_keys
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/.ssh/authorized_keys
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « sqli-21 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
SIGMA-web-credential-file
pat-0489
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred SSH authorized_keys
Ligne de requête
GET /.ssh/authorized_keys HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; JSN-AL00a Build/HONORJSN-AL00a; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044807 Mobile Safari/537.36 MMWEBID/1961 …
Règles WAF
sqli-21
rce-0
nosqli-3
Payload (extrait)
GET /.ssh/authorized_keys HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 9; JSN-AL00a Build/HONORJSN-A
Requête brute (extrait)
GET /.ssh/authorized_keys HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 9; JSN-AL00a Build/HONORJSN-AL00a; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044807 Mobile Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "ssh\/authorized_keys",
"http_ua_hash": "819057ea350b4bf1b66fa8659e7704a4d1fd547d",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "a25aaf7c350e380b4697c5b640d5d962e0f1dd91",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 418,
"payload_entropy": 5.624909716113328,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 100,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "fe3add64df13cebb24da0d9fc651ac4d6868d44e",
"event_fingerprint": "aff08a547cad639e3d5f8b0855aafba54e34aa86",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 225,
"precision_signals": [
"SIGMA-web-credential-file",
"pat-0489",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"SIGMA-web-credential-file",
"pat-0489",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0489"
],
"matched_pattern_names": [
"Cred SSH authorized_keys"
],
"pattern_ids": [
"pat-0489"
],
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fd79c2b812eab7b9c76fce38b65bafd9",
"payload_hash": "8c10df29c3a870a3906e4753db14490a",
"path_pattern_hash": "7cedd4ba646691da0a133647f6b04acc"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"method": "GET",
"path": "\/.ssh\/authorized_keys",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; JSN-AL00a Build\/HONORJSN-AL00a; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/66.0.3359.126 MQQBrowser\/6.2 TBS\/044807 Mobile Safari\/537.36 MMWEBID\/1961 MicroMessenger\/7.0.6.1460(0x27000634) Process\/tools NetT\u2026",
"waf_tags": [
"950086:sqli-21",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"sqli-21",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.ssh\/authorized_keys HTTP\/1.1",
"payload_snippet": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; JSN-AL00a Build\/HONORJSN-A",
"evidence": {
"method": "GET",
"path": "\/.ssh\/authorized_keys",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; JSN-AL00a Build\/HONORJSN-AL00a; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/66.0.3359.126 MQQBrowser\/6.2 TBS\/044807 Mobile Safari\/537.36 MMWEBID\/1961 MicroMessenger\/7.0.6.1460(0x27000634) Process\/tools NetT\u2026",
"waf_tags": [
"950086:sqli-21",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"sqli-21",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/.ssh\/authorized_keys HTTP\/1.1",
"request_sample": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; JSN-AL00a Build\/HONORJSN-AL00a; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/66.0.3359.126 MQQBrowser\/6.2 TBS\/044807 Mobile Safari\/537.36",
"payload_snippet": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; JSN-AL00a Build\/HONORJSN-A",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38d21571effeccd37f42f90432a7fc6033469949",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.ssh\/authorized_keys",
"request_line": "GET \/.ssh\/authorized_keys HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; JSN-AL00a Build\/HONORJSN-AL00a; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 C\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; JSN-AL00a Build\/HONORJSN-A",
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/authorized_keys",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab sqli-21 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"SIGMA-web-credential-file",
"pat-0489",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"SIGMA-web-credential-file",
"pat-0489",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/.ssh\/authorized_keys",
"request_line": "GET \/.ssh\/authorized_keys HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; JSN-AL00a Build\/HONORJSN-AL00a; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 C\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/.ssh\/authorized_keys",
"evidence_snippet": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; JSN-AL00a Build\/HONORJSN-A",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950086:sqli-21",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /mailer/sendgrid.js
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /mailer/sendgrid.js UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/mailer/sendgrid.js
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/mailer/sendgrid.js
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /mailer/sendgrid.js HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /mailer/sendgrid.js HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /mailer/sendgrid.js HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "js",
"http_ua_hash": "13330a7d3aaee1569dd7ceebc04360c8b673fb08",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "f0266273bf48ddd4776744bfb636ed48db1f9a0e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 243,
"payload_entropy": 5.453131919444421,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "b883520e6b3ab3cb5401a18fc0b8abda915ad893",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8790bcb5c8899608c144ab0e4b52234f",
"payload_hash": "8cd73138cb2e523afed8370062293155",
"path_pattern_hash": "6ecfd778a602d8c5515ae4f71e84d137"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/mailer\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, ",
"method": "GET",
"path": "\/mailer\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.109 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mailer\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/mailer\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.109 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mailer\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/mailer\/sendgrid.js",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.109 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mailer\/sendgrid.js HTTP\/1.1",
"request_sample": "GET \/mailer\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.109 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mailer\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f400e733030852c930a99a2dd22d020c0dbdbf8f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/sendgrid.js",
"request_line": "GET \/mailer\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.109 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mailer\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/sendgrid.js",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/sendgrid.js",
"request_line": "GET \/mailer\/sendgrid.js HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.109 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/sendgrid.js",
"evidence_snippet": "GET \/mailer\/sendgrid.js HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /mailer/sendgrid.py
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /mailer/sendgrid.py UA Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, …
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/mailer/sendgrid.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/mailer/sendgrid.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /mailer/sendgrid.py HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /mailer/sendgrid.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHT
Requête brute (extrait)
GET /mailer/sendgrid.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "a2bc8a66d217f6cc1c17827aa0c7cd8356021630",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "9b85ba3fc4ac4a1549d12be2ecef5722bb151f3a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 246,
"payload_entropy": 5.44438855623164,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "f3f5aebefd248dbb4afb421e58c3c3c7d101cc0f",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "e0576f3a0ae19cfab7b31303c43bf668",
"payload_hash": "51308a3dcd2a68a9acf812d1ce23b56e",
"path_pattern_hash": "8c4b21a7860b8f6d464d0085eb236a5b"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/mailer\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHT",
"method": "GET",
"path": "\/mailer\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mailer\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/mailer\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mailer\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHT",
"evidence": {
"method": "GET",
"path": "\/mailer\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mailer\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/mailer\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mailer\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHT",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "34aae42dd894aded8a060225ff57e4606b740c2a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/sendgrid.py",
"request_line": "GET \/mailer\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mailer\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHT",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/sendgrid.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/sendgrid.py",
"request_line": "GET \/mailer\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/56.0.2924.87 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/sendgrid.py",
"evidence_snippet": "GET \/mailer\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (KHT",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /mail/sendgrid.py
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /mail/sendgrid.py UA Mozilla/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit/537.3…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_mail
Cible HTTP
GET
/mail/sendgrid.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/mail/sendgrid.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /mail/sendgrid.py HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /mail/sendgrid.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit/537
Requête brute (extrait)
GET /mail/sendgrid.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clo
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "6e56501be3b5e1b7794d0660b2c5e7c7b3a89ef7",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "4e4e30676a1660aa4bddd155759e5f2063e42ebb",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.416184690745936,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "12ca6db403b5380b853185263f23bd96fc8c3f31",
"event_fingerprint": "89f9c7faed145655e022a8e27becd062f95797ee",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9dbcf054276cccf720582e34fa8660c6",
"payload_hash": "3aaa0389b7051bdb5535d90ee134e706",
"path_pattern_hash": "b5e77b51819ded84d893a1ced6a06cf4"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/mail\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537",
"method": "GET",
"path": "\/mail\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mail\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/mail\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/mail\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/mail\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mail\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/mail\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/mail\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "092ffb11cddba1516d796f96f054af2db48943ba",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mail\/sendgrid.py",
"request_line": "GET \/mail\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mail\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mail\/sendgrid.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mail\/sendgrid.py",
"request_line": "GET \/mail\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mail\/sendgrid.py",
"evidence_snippet": "GET \/mail\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; LG-H870DS) AppleWebKit\/537",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_mail",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /src/sendgrid.py
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/sendgrid.py UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/src/sendgrid.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/src/sendgrid.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/sendgrid.py HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /src/sendgrid.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (
Requête brute (extrait)
GET /src/sendgrid.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "4b8f4ac396f1b62ebfa2c42846baefac0464115b",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "1199ec6af8250c9d336ec91a467a574f2ae011ba",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 250,
"payload_entropy": 5.432747808118218,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "c23e86d678b57755fc658901d6785e66e0e44c3b",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "68dcf6050d8357f60ea15efa80eaa831",
"payload_hash": "6b6c2ce154c28d7ee209406789dff916",
"path_pattern_hash": "1599bd71dd6b66802ca7702f410c4986"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/src\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/src\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.108 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/src\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.108 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/src\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.108 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/src\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.108 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d8204eb44540d57a811d302ca11a71573c18aa4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/sendgrid.py",
"request_line": "GET \/src\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.108 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/sendgrid.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/sendgrid.py",
"request_line": "GET \/src\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.108 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/sendgrid.py",
"evidence_snippet": "GET \/src\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /config/sendgrid.py
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/sendgrid.py UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/sendgrid.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/config/sendgrid.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/sendgrid.py HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/sendgrid.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit
Requête brute (extrait)
GET /config/sendgrid.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "20059f00e7e34ed73ac43b40868cf1adca9ffd07",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "c39a8449a6e4f2889aa8a56e74d7dff99a1b9759",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.391729722703763,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "992c1bc2756564399d784e062f57d533de4c961d",
"event_fingerprint": "1da6d4b44fae08ef9733a5749e1962c835d1277c",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9e7a94a468bf50dfc2ed6e2c4bfd1897",
"payload_hash": "12f98b876c22b05c9991367fae91b0bc",
"path_pattern_hash": "9abcee9f2bf7633ad04f7c379dbcfd85"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/config\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"method": "GET",
"path": "\/config\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/config\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/config\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/config\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d1f7d0cd7561f39fc28417521e129b9bccc60ab7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.py",
"request_line": "GET \/config\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.py",
"request_line": "GET \/config\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/73.0.3683.103 Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.py",
"evidence_snippet": "GET \/config\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /config/sendgrid.json
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/sendgrid.json UA Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleW…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/sendgrid.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/config/sendgrid.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/sendgrid.json HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/11.0 Mobile/15D100 Safari/604.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/sendgrid.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X)
Requête brute (extrait)
GET /config/sendgrid.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/11.0 Mobile/15D100 Safari/604.1 Accept-Charset: utf-8 Accept-Encoding: gzip C
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "d718e91c69fe9a7668045f940cfbbcad19d57512",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "6c93d1b9fbdf8e8d128caa00a09f6faf39a40791",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 276,
"payload_entropy": 5.366124572079476,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "992c1bc2756564399d784e062f57d533de4c961d",
"event_fingerprint": "f271bd887981b97a93c2ec7207f7eea02b5ca9c4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6146ae6af886fef0cc77da517fab88c6",
"payload_hash": "37a414780dc67badfb2c87c6f0848412",
"path_pattern_hash": "b3c041376e66dccb94b76d7207504df9"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/config\/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) ",
"method": "GET",
"path": "\/config\/sendgrid.json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit\/604.5.6 (KHTML, like Gecko) Version\/11.0 Mobile\/15D100 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.json HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit\/604.5.6 (KHTML, like Gecko) Version\/11.0 Mobile\/15D100 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nC",
"payload_snippet": "GET \/config\/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X)",
"evidence": {
"method": "GET",
"path": "\/config\/sendgrid.json",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit\/604.5.6 (KHTML, like Gecko) Version\/11.0 Mobile\/15D100 Safari\/604.1",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.json HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit\/604.5.6 (KHTML, like Gecko) Version\/11.0 Mobile\/15D100 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nC",
"payload_snippet": "GET \/config\/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X)",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "db9265fbc25d8099645dfa418644e24391f15973",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.json",
"request_line": "GET \/config\/sendgrid.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit\/604.5.6 (KHTML, like Gecko) Version\/11.0 Mobile\/15\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X)",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.json",
"request_line": "GET \/config\/sendgrid.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X) AppleWebKit\/604.5.6 (KHTML, like Gecko) Version\/11.0 Mobile\/15\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.json",
"evidence_snippet": "GET \/config\/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_6 like Mac OS X)",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid.json
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid.json UA Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 F…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid.json HTTP/1.1
User-Agent
Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Fi
Requête brute (extrait)
GET /sendgrid.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "c3d61aef57572ee9a683638e153ed3d648d76c48",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "334746630c59d3caca795d70405b3b173f74a90b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 223,
"payload_entropy": 5.188262156099512,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "da0e92cd0ebb085b51990a0223f84b28a1dbd99e",
"event_fingerprint": "cad42f8dac086356e22a4bc489a6ab220f30235e",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "43a9d8b3b474751e8a43f92557eb8991",
"payload_hash": "84aac55146c9756bb52a9679ca296dea",
"path_pattern_hash": "e6f5fbc298134f1524aeaece47705fce"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Fi",
"method": "GET",
"path": "\/sendgrid.json",
"user_agent": "Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 Fennec\/10.0.1",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.json HTTP\/1.1",
"request_sample": "GET \/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 Fennec\/10.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Fi",
"evidence": {
"method": "GET",
"path": "\/sendgrid.json",
"user_agent": "Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 Fennec\/10.0.1",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.json HTTP\/1.1",
"request_sample": "GET \/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 Fennec\/10.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Fi",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2589feba98a38aa9a4420adc8fdc16c4a3ebb631",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.json",
"request_line": "GET \/sendgrid.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 Fennec\/10.0.1",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Fi",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.json",
"request_line": "GET \/sendgrid.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Firefox\/10.0.1 Fennec\/10.0.1",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.json",
"evidence_snippet": "GET \/sendgrid.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko\/20100101 Fi",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /backend/sendgrid.py
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/sendgrid.py UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/backend/sendgrid.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/sendgrid.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/sendgrid.py HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/sendgrid.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKi
Requête brute (extrait)
GET /backend/sendgrid.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "8db97399182c6551604c2503977d4d68963fecc1",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "9b3b3fd51ae018208ce4d96cbad2187f4475e746",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 260,
"payload_entropy": 5.435807111413181,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "d0b08fd7b2a1c0cb4f61033c4e4745ce2f501dcc",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "b8b0bc6ab8272ad400331b5f1f74c189",
"payload_hash": "24a923841d8b2849e69ea2ffa1058aae",
"path_pattern_hash": "ecf29d1ed95b1fd215637cce0a9e7303"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/backend\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKi",
"method": "GET",
"path": "\/backend\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/backend\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/backend\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/backend\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/backend\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/backend\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKi",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d11e71392745be4f2cce95a3eef52caa682535a9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/sendgrid.py",
"request_line": "GET \/backend\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKi",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/sendgrid.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/sendgrid.py",
"request_line": "GET \/backend\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/sendgrid.py",
"evidence_snippet": "GET \/backend\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKi",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /config/sendgrid.yml
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/sendgrid.yml UA Mozilla/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/sendgrid.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/config/sendgrid.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/sendgrid.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/sendgrid.yml HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit/537.3
Requête brute (extrait)
GET /config/sendgrid.yml HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "23a16c385992f56c2e015dfdea350e8d5a7fd397",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "0bd9f817e7997b41e7d0b8b8dd114ee25267d094",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 260,
"payload_entropy": 5.413712868116136,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "992c1bc2756564399d784e062f57d533de4c961d",
"event_fingerprint": "cc1511b55e1c5e4f6156c4dacf737ce2bf875b90",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d2c19e6bb49ac753eeb3bb652c7f87db",
"payload_hash": "ddd9080a9349fa7ae2af20cd0d46aee6",
"path_pattern_hash": "b33a5d11f328bd7713feb258f3d7e0c0"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/config\/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.3",
"method": "GET",
"path": "\/config\/sendgrid.yml",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.yml HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/config\/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.3",
"evidence": {
"method": "GET",
"path": "\/config\/sendgrid.yml",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.yml HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/config\/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c56a75b5e6b319df202ae8d7e2fa571b478614ec",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.yml",
"request_line": "GET \/config\/sendgrid.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.3",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.yml",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.yml",
"request_line": "GET \/config\/sendgrid.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.yml",
"evidence_snippet": "GET \/config\/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LLD-AL10) AppleWebKit\/537.3",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid.yaml
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid.yaml UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid.yaml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid.yaml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid.yaml HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid.yaml HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH
Requête brute (extrait)
GET /sendgrid.yaml HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yaml",
"http_ua_hash": "37a14ab67d3294a3b44a0052de24249abeddc0b7",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "6ddb9259a81c5943f174c8762a08f320950440bd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 248,
"payload_entropy": 5.4167202900650695,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "da0e92cd0ebb085b51990a0223f84b28a1dbd99e",
"event_fingerprint": "fa894a04ec5a477179f1eea001b4be34d34ae21e",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1ccd4ec1df8c467e14234584945653a1",
"payload_hash": "36079c835c5ba2a6cf8054de70fb0b07",
"path_pattern_hash": "586d42da805584afffe4b06de4328fe7"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/sendgrid.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"method": "GET",
"path": "\/sendgrid.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/65.0.3325.146 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.yaml HTTP\/1.1",
"request_sample": "GET \/sendgrid.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/65.0.3325.146 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"evidence": {
"method": "GET",
"path": "\/sendgrid.yaml",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/65.0.3325.146 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.yaml HTTP\/1.1",
"request_sample": "GET \/sendgrid.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/65.0.3325.146 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ceb21d1bd0d0810cd9bf78d972b7fcce9c1ab02",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.yaml",
"request_line": "GET \/sendgrid.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/65.0.3325.146 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.yaml",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.yaml",
"request_line": "GET \/sendgrid.yaml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/65.0.3325.146 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.yaml",
"evidence_snippet": "GET \/sendgrid.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KH",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /mailer/sendgrid.php
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /mailer/sendgrid.php UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/mailer/sendgrid.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/mailer/sendgrid.php
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /mailer/sendgrid.php HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3889.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /mailer/sendgrid.php HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
Requête brute (extrait)
GET /mailer/sendgrid.php HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3889.0 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": "e982d91b0f50d80f0f3ba493fdaaceb5286071d2",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "dae727d8f431c63a4890b644ed3bde6b8b286d4f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 242,
"payload_entropy": 5.431824004014075,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "ec2f0ac36df969221252eb3863f926a7406874fa",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6de29d4d4ac426bc6dcee957ec7e28a4",
"payload_hash": "6b903b5d44e529edd81d32bab1b0165b",
"path_pattern_hash": "efcedb7b18ae8ea8d96de301e7bc027e"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/mailer\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"method": "GET",
"path": "\/mailer\/sendgrid.php",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mailer\/sendgrid.php HTTP\/1.1",
"request_sample": "GET \/mailer\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mailer\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"evidence": {
"method": "GET",
"path": "\/mailer\/sendgrid.php",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/mailer\/sendgrid.php HTTP\/1.1",
"request_sample": "GET \/mailer\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/mailer\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ac6ec1e4f6cf70b6472e1f444e0b53d141c25a0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/sendgrid.php",
"request_line": "GET \/mailer\/sendgrid.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mailer\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/sendgrid.php",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/sendgrid.php",
"request_line": "GET \/mailer\/sendgrid.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3889.0 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/sendgrid.php",
"evidence_snippet": "GET \/mailer\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML,",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid-config.json
Élevée
Moyen · 51
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid-config.json UA Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.6 (KHTML, like Gec…
Émulateur
HTTP
WAF
6
Recommandation
Investiguer
Tags
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid-config.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid-config.json
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 51
Confiance : Confiance 100 % — 1 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid-config.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.6 (KHTML, like Gecko) Chrome/20.0.1090.0 Safari/536.6
Règles WAF
nosqli-3
Payload (extrait)
GET /sendgrid-config.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.6 (KHTML, li
Requête brute (extrait)
GET /sendgrid-config.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.6 (KHTML, like Gecko) Chrome/20.0.1090.0 Safari/536.6 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "bd5a8030af6ba252c553877c215a975bb099d9f7",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "7d5ebcf94187fd12c4375ea09c6c54bd408b8303",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 238,
"payload_entropy": 5.335565411160205,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 32,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "497c34ce97a336237e808c18e5c854c4b9d65ccf",
"event_fingerprint": "c4e478eb19b0f7a9680de800512e6f97b267aed1",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 147,
"precision_signals": [
"MITRE-T1499",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d48dd1a58d66c5711aeaa6ba5a6310e0",
"payload_hash": "aa0d8491d42a8a715f4ff8cb20a26baa",
"path_pattern_hash": "170a7f6ff312a524729718105c471f02"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/sendgrid-config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, li",
"method": "GET",
"path": "\/sendgrid-config.json",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, like Gecko) Chrome\/20.0.1090.0 Safari\/536.6",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sendgrid-config.json HTTP\/1.1",
"request_sample": "GET \/sendgrid-config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, like Gecko) Chrome\/20.0.1090.0 Safari\/536.6\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid-config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, li",
"evidence": {
"method": "GET",
"path": "\/sendgrid-config.json",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, like Gecko) Chrome\/20.0.1090.0 Safari\/536.6",
"waf_tags": [
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/sendgrid-config.json HTTP\/1.1",
"request_sample": "GET \/sendgrid-config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, like Gecko) Chrome\/20.0.1090.0 Safari\/536.6\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid-config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, li",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0721ed33fb2566ba4c3355b995ab41531abfb426",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid-config.json",
"request_line": "GET \/sendgrid-config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, like Gecko) Chrome\/20.0.1090.0 Safari\/536.6",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid-config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, li",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid-config.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 32,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid-config.json",
"request_line": "GET \/sendgrid-config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, like Gecko) Chrome\/20.0.1090.0 Safari\/536.6",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid-config.json",
"evidence_snippet": "GET \/sendgrid-config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/536.6 (KHTML, li",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid.yml
Élevée
Moyen · 51
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid.yml UA Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)
Émulateur
HTTP
WAF
7
Recommandation
Investiguer
Tags
950326:rce-0
net_flood
Cible HTTP
GET
/sendgrid.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 51
Confiance : Confiance 100 % — 1 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid.yml HTTP/1.1
User-Agent
Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)
Règles WAF
rce-0
Payload (extrait)
GET /sendgrid.yml HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)
Accept-Ch
Requête brute (extrait)
GET /sendgrid.yml HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "yml",
"http_ua_hash": "88b419ccd78e3c236f4ba256a3fcd7d711d3d347",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "fe30445de825aa0bffca483abd821a9f6a87533d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 186,
"payload_entropy": 5.243187034033232,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 36,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 36,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 51,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "e486090e1aac6845061fae1acb043b2c52453a27",
"event_fingerprint": "10fe8c85b2bd2f05983824281c4d64c8a95a01da",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 147,
"precision_signals": [
"MITRE-T1499",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream"
],
"confidence_breakdown": {
"waf": 36,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7b813d2f43cf789190921d925dbaa4e3",
"payload_hash": "1b0543dc590e0b422c28a5db1866db40",
"path_pattern_hash": "7777bc3cc4ee53dc76c001dce4e79fd5"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 51
},
"payload_preview": "GET \/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)\r\nAccept-Ch",
"method": "GET",
"path": "\/sendgrid.yml",
"user_agent": "Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)",
"waf_tags": [
"950326:rce-0"
],
"waf_rule_names": [
"rce-0"
],
"request_line": "GET \/sendgrid.yml HTTP\/1.1",
"request_sample": "GET \/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)\r\nAccept-Ch",
"evidence": {
"method": "GET",
"path": "\/sendgrid.yml",
"user_agent": "Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)",
"waf_tags": [
"950326:rce-0"
],
"waf_rule_names": [
"rce-0"
],
"request_line": "GET \/sendgrid.yml HTTP\/1.1",
"request_sample": "GET \/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)\r\nAccept-Ch",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "582085034351c7d9283513deaf3dfd64ffcf7734",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.yml",
"request_line": "GET \/sendgrid.yml HTTP\/1.1",
"http_user_agent": "Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)\r\nAccept-Ch",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.yml",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 36,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 51,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 51,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.yml",
"request_line": "GET \/sendgrid.yml HTTP\/1.1",
"http_user_agent": "Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.yml",
"evidence_snippet": "GET \/sendgrid.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Links (2.3pre1; Linux 2.6.38-8-generic x86_64; 170x48)\r\nAccept-Ch",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 36 \u00b7 Bonus corr\u00e9lation +8 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid.php
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid.php UA Mozilla/5.0 (OS/2; Warp 4.5; rv:24.0) Gecko/20100101 Firefox/24…
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950318:lfi-14
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid.php
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid.php HTTP/1.1
User-Agent
Mozilla/5.0 (OS/2; Warp 4.5; rv:24.0) Gecko/20100101 Firefox/24.0 SeaMonkey/2.21
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid.php HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (OS/2; Warp 4.5; rv:24.0) Gecko/20100101 Firefox/24.0
Requête brute (extrait)
GET /sendgrid.php HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (OS/2; Warp 4.5; rv:24.0) Gecko/20100101 Firefox/24.0 SeaMonkey/2.21 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "php",
"http_ua_hash": "3e979b162d12946ba679ba22ab0e70b6981ce081",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "aeebeac9e1ed0166b8b2a8b12207a52ac16be70d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.296895086358797,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 92,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 67,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1611a821b1cea7ed6aed3693e3ca2c41d5838222",
"event_fingerprint": "b360314768d2b621cf68a4fd7b574c0b81f58856",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 67,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "23d28b3de0f60a0b4bf83ad2d15c780a",
"payload_hash": "087f09dea56888129b050434714f36fb",
"path_pattern_hash": "1c628b1c6b42ab40202a01c40f9a976e"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0",
"method": "GET",
"path": "\/sendgrid.php",
"user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0 SeaMonkey\/2.21",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.php HTTP\/1.1",
"request_sample": "GET \/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0 SeaMonkey\/2.21\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0",
"evidence": {
"method": "GET",
"path": "\/sendgrid.php",
"user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0 SeaMonkey\/2.21",
"waf_tags": [
"950318:lfi-14",
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.php HTTP\/1.1",
"request_sample": "GET \/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0 SeaMonkey\/2.21\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "89b3cdfbfadc6b2f61f6afa2059cbca7c7a77d34",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.php",
"request_line": "GET \/sendgrid.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0 SeaMonkey\/2.21",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.php",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 67,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.php",
"request_line": "GET \/sendgrid.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0 SeaMonkey\/2.21",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.php",
"evidence_snippet": "GET \/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (OS\/2; Warp 4.5; rv:24.0) Gecko\/20100101 Firefox\/24.0",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950318:lfi-14",
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /app/sendgrid.py
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /app/sendgrid.py UA Mozilla/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit/537.36 (KHT…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/app/sendgrid.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/app/sendgrid.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/sendgrid.py HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app/sendgrid.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit/537.36 (KH
Requête brute (extrait)
GET /app/sendgrid.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "206a1505c3d2cd161df512e2a8c0076f16f0edf8",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "a743b8206ca823c369ef5eb8bfeb21a48b56cf7e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.4277537375581275,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "f68063024d4eff4266bb50c84c36cb44f44a510d",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c31c831c1c3a7f5549c146d9032e0e02",
"payload_hash": "b6d7ed20e3eddc7af8b743af65cd1b7f",
"path_pattern_hash": "bbc1021582141e8e631079ccf6c69d4d"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/app\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KH",
"method": "GET",
"path": "\/app\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/app\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KH",
"evidence": {
"method": "GET",
"path": "\/app\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/app\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/app\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KH",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef11008785c8f3e0423282e84b9a98fabb8cee8c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/sendgrid.py",
"request_line": "GET \/app\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KH",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/sendgrid.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/sendgrid.py",
"request_line": "GET \/app\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/sendgrid.py",
"evidence_snippet": "GET \/app\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ANE-LX1) AppleWebKit\/537.36 (KH",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /email/sendgrid.py
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /email/sendgrid.py UA Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Ge…
Émulateur
HTTP
WAF
12
Recommandation
Investiguer
Tags
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/email/sendgrid.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/email/sendgrid.py
Pourquoi cette classification : Tags WAF: nosqli-3 · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /email/sendgrid.py HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 OPR/62.0.3331.116
Règles WAF
nosqli-3
Payload (extrait)
GET /email/sendgrid.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like
Requête brute (extrait)
GET /email/sendgrid.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 OPR/62.0.3331.116 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "c0c58b502ed8d69947ff17e3036c89115a366cc1",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "190af723c99988769325445339d91d711879f378",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 257,
"payload_entropy": 5.399661775340261,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 56,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 56,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d9881a5c1e7cf8b0176188425d6a1b905bd40799",
"event_fingerprint": "7996677f4495f0a300b62527db67a02d88508420",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 56,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "70122e1c6e681206265a5e07da242e33",
"payload_hash": "854b5f4f5fa6260ce1c93a5ece7a406a",
"path_pattern_hash": "aa093fa1b6f985e5ed81b711d71d6186"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/email\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like",
"method": "GET",
"path": "\/email\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/email\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/email\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
"payload_snippet": "GET \/email\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/email\/sendgrid.py",
"user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116",
"waf_tags": [
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"nosqli-3"
],
"request_line": "GET \/email\/sendgrid.py HTTP\/1.1",
"request_sample": "GET \/email\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
"payload_snippet": "GET \/email\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like",
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4aaff2b060907ed90d19208e8cb17e7dad5be3c1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/email\/sendgrid.py",
"request_line": "GET \/email\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/email\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/email\/sendgrid.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: nosqli-3 \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 56,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/email\/sendgrid.py",
"request_line": "GET \/email\/sendgrid.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36 OPR\/62.0.3331.116",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/email\/sendgrid.py",
"evidence_snippet": "GET \/email\/sendgrid.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 56 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /config/sendgrid.php
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /config/sendgrid.php UA Mozilla/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit/537.36 (…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_probe_config
Cible HTTP
GET
/config/sendgrid.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/config/sendgrid.php
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /config/sendgrid.php HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /config/sendgrid.php HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit/537
Requête brute (extrait)
GET /config/sendgrid.php HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clo
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": "3160c2e9878e0fe397da006c34bfeb6f3f44a29f",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "5a7c4db4e49228f435e7f3ef670fd7a77af86fbd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 262,
"payload_entropy": 5.407960749961497,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "992c1bc2756564399d784e062f57d533de4c961d",
"event_fingerprint": "92cb0bfcad0fb604dccd52c121a96a0a304eefd9",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "622d2920bfec1abd80604bdcdf49d52c",
"payload_hash": "917929e2942b57dd531db2b77e6a68bd",
"path_pattern_hash": "c0ea70e9176b91c1342a31c50481c975"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/config\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537",
"method": "GET",
"path": "\/config\/sendgrid.php",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.php HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/config\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537",
"evidence": {
"method": "GET",
"path": "\/config\/sendgrid.php",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/config\/sendgrid.php HTTP\/1.1",
"request_sample": "GET \/config\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clo",
"payload_snippet": "GET \/config\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d688d431e5c07d74a028ad53f087e8f32c850e9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.php",
"request_line": "GET \/config\/sendgrid.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/53\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.php",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/sendgrid.php",
"request_line": "GET \/config\/sendgrid.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/74.0.3729.157 Mobile Safari\/53\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/sendgrid.php",
"evidence_snippet": "GET \/config\/sendgrid.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G955U) AppleWebKit\/537",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_probe_config",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /sendgrid.config.json
Élevée
Moyen · 56
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /sendgrid.config.json UA Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
net_flood
Cible HTTP
GET
/sendgrid.config.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/sendgrid.config.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 56
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /sendgrid.config.json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /sendgrid.config.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.
Requête brute (extrait)
GET /sendgrid.config.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clos
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "json",
"http_ua_hash": "313d04a6271d72d8bdffdf729f500205ab4255ef",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "eeb189e33107611f717db38a6842e4ac40f53918",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 261,
"payload_entropy": 5.409427475587634,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 60,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 56,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "da0e92cd0ebb085b51990a0223f84b28a1dbd99e",
"event_fingerprint": "b1677d2b506c4cabd5393e8fd7623b5460926a36",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a8d77e7f4c0c03c9696794aa1e4b22a3",
"payload_hash": "123b45fc64e6df3ddfc50a4f29f7a71c",
"path_pattern_hash": "d03aef47d2b763bc56a13f3ba838e778"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 56
},
"payload_preview": "GET \/sendgrid.config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.",
"method": "GET",
"path": "\/sendgrid.config.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.config.json HTTP\/1.1",
"request_sample": "GET \/sendgrid.config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clos",
"payload_snippet": "GET \/sendgrid.config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/sendgrid.config.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/sendgrid.config.json HTTP\/1.1",
"request_sample": "GET \/sendgrid.config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clos",
"payload_snippet": "GET \/sendgrid.config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c794b0679a3cdd7157236f0e640a466cd33ec1c8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.config.json",
"request_line": "GET \/sendgrid.config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid.config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.config.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 56,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 56,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid.config.json",
"request_line": "GET \/sendgrid.config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.143 Mobile Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid.config.json",
"evidence_snippet": "GET \/sendgrid.config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G950F) AppleWebKit\/537.",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:26 UTC
TCP
8300 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8300 · (tentative d'exploit) · → /private/secrets.json
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /private/secrets.json UA Mozilla/5.0 (Linux; U; Android 9; en-US; RMX1851 Build/PKQ1.190…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_k8s_probe
Cible HTTP
GET
/private/secrets.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/private/secrets.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0496
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets JSON file
Ligne de requête
GET /private/secrets.json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 9; en-US; RMX1851 Build/PKQ1.190101.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.12.8.1206 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /private/secrets.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; U; Android 9; en-US; RMX1851 Build/PK
Requête brute (extrait)
GET /private/secrets.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; U; Android 9; en-US; RMX1851 Build/PKQ1.190101.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.12.8.1206 Mobile Safari/537.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "3a14bddb91326f82bca01823b764984b5c5381db",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "1a592bf2c5d0fa0649bfef76bf43dc28f3f43a27",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 327,
"payload_entropy": 5.473780132749371,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "7a3ce05d08f518bdd9379390237672c4775324f5",
"event_fingerprint": "0563e442ac6caa270591d34d426abd7762268aa7",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0496"
],
"matched_pattern_names": [
"Cred Secrets JSON file"
],
"pattern_ids": [
"pat-0496"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "739405f2eeb60b263b435d51ae68bfdb",
"payload_hash": "2fdcc89e0aa1247b6f3186e9f65ed7c5",
"path_pattern_hash": "28bdca9eb7d8c2f1408ad5c40bac8497"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PK",
"method": "GET",
"path": "\/private\/secrets.json",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PKQ1.190101.001) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/57.0.2987.108 UCBrowser\/12.12.8.1206 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/private\/secrets.json HTTP\/1.1",
"request_sample": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PKQ1.190101.001) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/57.0.2987.108 UCBrowser\/12.12.8.1206 Mobile Safari\/537.",
"payload_snippet": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PK",
"evidence": {
"method": "GET",
"path": "\/private\/secrets.json",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PKQ1.190101.001) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/57.0.2987.108 UCBrowser\/12.12.8.1206 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/private\/secrets.json HTTP\/1.1",
"request_sample": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PKQ1.190101.001) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/57.0.2987.108 UCBrowser\/12.12.8.1206 Mobile Safari\/537.",
"payload_snippet": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PK",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c5300119ca83e173874259d21d7ff78ddddd27fc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/secrets.json",
"request_line": "GET \/private\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PKQ1.190101.001) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PK",
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/secrets.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0496",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/private\/secrets.json",
"request_line": "GET \/private\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PKQ1.190101.001) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/secrets.json",
"evidence_snippet": "GET \/private\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 9; en-US; RMX1851 Build\/PK",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_k8s_probe",
"http_probe_private",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8300 · (tentative d'exploit) · → /backend/config.php
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/config.php UA Mozilla/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Build/SH…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_sensitive_path
Cible HTTP
GET
/backend/config.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/config.php
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Generic config.php
Ligne de requête
GET /backend/config.php HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Build/SHOLS_U2_01.14.0) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/config.php HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Buil
Requête brute (extrait)
GET /backend/config.php HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Build/SHOLS_U2_01.14.0) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17 Accept-Charset: utf-8 Accept-Encod
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": "70744f52ffc4fbbd21555ebcded90ba858af0058",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "0f76041769be813ece64207c970ee1807850a543",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 288,
"payload_entropy": 5.395697927563689,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b6c81f3f707a44df21abac2e5bb864841dd56ef",
"event_fingerprint": "c1cf6cad6568d25c5c525f5ba0d9ebf665c8f5f3",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0118"
],
"matched_pattern_names": [
"LFI Generic config.php"
],
"pattern_ids": [
"pat-0118"
],
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "563ba6ae53e430e3e704d26d9387d4d9",
"payload_hash": "de07e7c3711413803a2ad036d5c7771e",
"path_pattern_hash": "5736f534a7045a63aa72293badb5c26d"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/backend\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Buil",
"method": "GET",
"path": "\/backend\/config.php",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Build\/SHOLS_U2_01.14.0) AppleWebKit\/530.17 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/530.17",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/config.php HTTP\/1.1",
"request_sample": "GET \/backend\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Build\/SHOLS_U2_01.14.0) AppleWebKit\/530.17 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/530.17\r\nAccept-Charset: utf-8\r\nAccept-Encod",
"payload_snippet": "GET \/backend\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Buil",
"evidence": {
"method": "GET",
"path": "\/backend\/config.php",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Build\/SHOLS_U2_01.14.0) AppleWebKit\/530.17 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/530.17",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/config.php HTTP\/1.1",
"request_sample": "GET \/backend\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Build\/SHOLS_U2_01.14.0) AppleWebKit\/530.17 (KHTML, like Gecko) Version\/4.0 Mobile Safari\/530.17\r\nAccept-Charset: utf-8\r\nAccept-Encod",
"payload_snippet": "GET \/backend\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Buil",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f5a5c90445836365fffe5b23d14efbdac481349",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/config.php",
"request_line": "GET \/backend\/config.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Build\/SHOLS_U2_01.14.0) AppleWebKit\/530.17 (KHTML, like Gecko) V\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Buil",
"attack_vector": "config file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/config.php",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/config.php",
"request_line": "GET \/backend\/config.php HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Build\/SHOLS_U2_01.14.0) AppleWebKit\/530.17 (KHTML, like Gecko) V\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/config.php",
"evidence_snippet": "GET \/backend\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 2.0.1; de-de; Milestone Buil",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8300 · (tentative d'exploit) · → /backend/config.json
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/config.json UA Mozilla/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit/537.3…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_sensitive_path
Cible HTTP
GET
/backend/config.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/config.json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/config.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit/
Requête brute (extrait)
GET /backend/config.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: c
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "4a3b6638a5bd98d453927c56d6ef158b38f76f49",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "dd4e7c6dae63b29d8a16bb2d08dd16eadae1388d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.442959519654111,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b6c81f3f707a44df21abac2e5bb864841dd56ef",
"event_fingerprint": "3cfe0723933e18215030a905c7370e5b12a2897b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "bf714196eb558876c98432af31c49c70",
"payload_hash": "31e2a9c20a99aa70f5c9f158d0b54234",
"path_pattern_hash": "6b5c0538270e7ecfd1e78d9e9655554f"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/backend\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/",
"method": "GET",
"path": "\/backend\/config.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/config.json HTTP\/1.1",
"request_sample": "GET \/backend\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c",
"payload_snippet": "GET \/backend\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/",
"evidence": {
"method": "GET",
"path": "\/backend\/config.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/config.json HTTP\/1.1",
"request_sample": "GET \/backend\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: c",
"payload_snippet": "GET \/backend\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "22b1845edd4a31aa5660e55b4dbaf438e925ae32",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/config.json",
"request_line": "GET \/backend\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/",
"attack_vector": "config file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/config.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/config.json",
"request_line": "GET \/backend\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/config.json",
"evidence_snippet": "GET \/backend\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ONEPLUS A5010) AppleWebKit\/",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /app/application.properties
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /app/application.properties UA Mozilla/5.0 (Linux; Android 7.0; XT1585) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/app/application.properties
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/app/application.properties
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/application.properties HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.0; XT1585) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app/application.properties HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 7.0; XT1585) AppleWebKi
Requête brute (extrait)
GET /app/application.properties HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 7.0; XT1585) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "properties",
"http_ua_hash": "756b895171ba47b83f4adb6ddfae0a803a0902ab",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "2f953c642188869b1a561e9c4740c219cba11ed1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 267,
"payload_entropy": 5.322978535775844,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "87114b64334000ea496880d2eda5cb62520390e4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "79e51b2c6d7d52a59a21605866647b03",
"payload_hash": "b448ad94f696ed70a406d62614aa6800",
"path_pattern_hash": "286c03092fb4d6bd8948d162eabf9d1a"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/app\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKi",
"method": "GET",
"path": "\/app\/application.properties",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/application.properties HTTP\/1.1",
"request_sample": "GET \/app\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection",
"payload_snippet": "GET \/app\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKi",
"evidence": {
"method": "GET",
"path": "\/app\/application.properties",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/application.properties HTTP\/1.1",
"request_sample": "GET \/app\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection",
"payload_snippet": "GET \/app\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKi",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f65f875b43ba34456ef4c2cd67f9e52dd8927704",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/application.properties",
"request_line": "GET \/app\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKi",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/application.properties",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/application.properties",
"request_line": "GET \/app\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.101 Mobile Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/application.properties",
"evidence_snippet": "GET \/app\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; XT1585) AppleWebKi",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /app/parameters.yml
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /app/parameters.yml UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/app/parameters.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/app/parameters.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /app/parameters.yml HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /app/parameters.yml HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit
Requête brute (extrait)
GET /app/parameters.yml HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "9bb0c860e00cb48c94d658e155063f950c3d9fa5",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "4f55dc51ea1dea9fa7f5925bb0b65cb16d0fdae1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 257,
"payload_entropy": 5.343914499347001,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "73ab520efadf0f0ee4f8bfe5dc191b1c756fcd5e",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c7b34d5fd360325ba4d502a7fece9657",
"payload_hash": "b9073c03de6f731afeae8875aa6b6b8a",
"path_pattern_hash": "59785b98ffcc7d5aed7dc5ac932d796d"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/app\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit",
"method": "GET",
"path": "\/app\/parameters.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/parameters.yml HTTP\/1.1",
"request_sample": "GET \/app\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
"payload_snippet": "GET \/app\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/app\/parameters.yml",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/app\/parameters.yml HTTP\/1.1",
"request_sample": "GET \/app\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
"payload_snippet": "GET \/app\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b37ba53cb0b5fd4733857ca5802884a5c633483f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/parameters.yml",
"request_line": "GET \/app\/parameters.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/parameters.yml",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/parameters.yml",
"request_line": "GET \/app\/parameters.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.3 Safari\/605.1.15",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/parameters.yml",
"evidence_snippet": "GET \/app\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8300 · (tentative d'exploit) · → /backend/database.php
Élevée
Élevé · 70
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /backend/database.php UA Gaisbot/3.0 (robot@gais.cs.ccu.edu.tw; http://gais.cs.ccu.edu.t…
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950310:lfi-12
950318:lfi-14
950326:rce-0
950406:ssrf-3
Cible HTTP
GET
/backend/database.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/database.php
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 70
Confiance : Confiance 100 % — 6 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100-sub
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /backend/database.php HTTP/1.1
User-Agent
Gaisbot/3.0 (robot@gais.cs.ccu.edu.tw; http://gais.cs.ccu.edu.tw/robot.php)
Règles WAF
lfi-12
lfi-14
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /backend/database.php HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Gaisbot/3.0 (robot@gais.cs.ccu.edu.tw; http://gais.cs.ccu
Requête brute (extrait)
GET /backend/database.php HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Gaisbot/3.0 (robot@gais.cs.ccu.edu.tw; http://gais.cs.ccu.edu.tw/robot.php) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": "e303cafa16cffb83fe9920e4b803b7bfce58cd74",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "b8d945b65dbbe419d52ebdd552c143c70925f067",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 215,
"payload_entropy": 5.05583705356316,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.1,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 70,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "f26d42542ae72f12a07389e7c7f92993c2a8353f",
"event_fingerprint": "979c0ba109aad1801ed5c585c39995b87ea0f719",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 140,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "715818dd0b717f3460b481c0fc9c521d",
"payload_hash": "e8a63100ef8343b685f0ff4d6c5ed222",
"path_pattern_hash": "0b2570d8cc30161bb9d1f6c9f069b923"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 70
},
"payload_preview": "GET \/backend\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu",
"method": "GET",
"path": "\/backend\/database.php",
"user_agent": "Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)",
"waf_tags": [
"950310:lfi-12",
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/backend\/database.php HTTP\/1.1",
"request_sample": "GET \/backend\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu",
"evidence": {
"method": "GET",
"path": "\/backend\/database.php",
"user_agent": "Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)",
"waf_tags": [
"950310:lfi-12",
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"lfi-14",
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/backend\/database.php HTTP\/1.1",
"request_sample": "GET \/backend\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "65148beb438c4b266f2372a9dbfbc8286be3750f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/database.php",
"request_line": "GET \/backend\/database.php HTTP\/1.1",
"http_user_agent": "Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/database.php",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 70,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 70,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/database.php",
"request_line": "GET \/backend\/database.php HTTP\/1.1",
"http_user_agent": "Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu.edu.tw\/robot.php)",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/database.php",
"evidence_snippet": "GET \/backend\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Gaisbot\/3.0 (robot@gais.cs.ccu.edu.tw; http:\/\/gais.cs.ccu",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950310:lfi-12",
"950318:lfi-14",
"950326:rce-0",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /backend/appsettings.json
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/appsettings.json UA Mozilla/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/backend/appsettings.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/appsettings.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred ASP.NET settings
Ligne de requête
GET /backend/appsettings.json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/appsettings.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit
Requête brute (extrait)
GET /backend/appsettings.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "6db5a3149771ca2ccbc88247150379bb7fb8f492",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "87d147cfb97251a67e3afa1a2c951c172ac2ad79",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 266,
"payload_entropy": 5.40932111102155,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d390d5f0c1e4a73e6f870e3b7f808aa01c4f741f",
"event_fingerprint": "3f041e67a96ca29003d206033a5ed813ccd46fc2",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0466"
],
"matched_pattern_names": [
"Cred ASP.NET settings"
],
"pattern_ids": [
"pat-0466"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "54f4fdf0c1513a3bfb676ab12b95a518",
"payload_hash": "72b9e222d77dfaf40a66730e8eaa97c4",
"path_pattern_hash": "066ff330e33172160b81f495921b3736"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/backend\/appsettings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit",
"method": "GET",
"path": "\/backend\/appsettings.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/appsettings.json HTTP\/1.1",
"request_sample": "GET \/backend\/appsettings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection:",
"payload_snippet": "GET \/backend\/appsettings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit",
"evidence": {
"method": "GET",
"path": "\/backend\/appsettings.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/appsettings.json HTTP\/1.1",
"request_sample": "GET \/backend\/appsettings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection:",
"payload_snippet": "GET \/backend\/appsettings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77a2c715e7d34e5c22a80dcd0cbb8095a8847c55",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/appsettings.json",
"request_line": "GET \/backend\/appsettings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/appsettings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/appsettings.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/appsettings.json",
"request_line": "GET \/backend\/appsettings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/appsettings.json",
"evidence_snippet": "GET \/backend\/appsettings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; LM-G710VM) AppleWebKit",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /backend/config.yml
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/config.yml UA Opera/9.80 (J2ME/MIDP; Opera Mini/8.0.35626/37.8918; U; en) Pre…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/backend/config.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/config.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/config.yml HTTP/1.1
User-Agent
Opera/9.80 (J2ME/MIDP; Opera Mini/8.0.35626/37.8918; U; en) Presto/2.12.423 Version/12.16
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/config.yml HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Opera/9.80 (J2ME/MIDP; Opera Mini/8.0.35626/37.8918; U; en)
Requête brute (extrait)
GET /backend/config.yml HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Opera/9.80 (J2ME/MIDP; Opera Mini/8.0.35626/37.8918; U; en) Presto/2.12.423 Version/12.16 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "61dc51bd062466ce962134c3971cff96a18e58f9",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "a126963d241c6de5415e84028949599a8cc00b17",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 227,
"payload_entropy": 5.337140838217029,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d390d5f0c1e4a73e6f870e3b7f808aa01c4f741f",
"event_fingerprint": "6d0110b7a6a34ec5b7f99aa1287eee6f9a8b8ca0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5805bdaf952e80c242d413cdcc00ebaf",
"payload_hash": "f3ad441fd952b3fb686a80ab8117391d",
"path_pattern_hash": "db11239f2df73531510aaf9c947f6a5d"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/backend\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en)",
"method": "GET",
"path": "\/backend\/config.yml",
"user_agent": "Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en) Presto\/2.12.423 Version\/12.16",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/config.yml HTTP\/1.1",
"request_sample": "GET \/backend\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en) Presto\/2.12.423 Version\/12.16\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en)",
"evidence": {
"method": "GET",
"path": "\/backend\/config.yml",
"user_agent": "Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en) Presto\/2.12.423 Version\/12.16",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/config.yml HTTP\/1.1",
"request_sample": "GET \/backend\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en) Presto\/2.12.423 Version\/12.16\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en)",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "275e89f9ff48773bb14f385db20df340ef35611a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/config.yml",
"request_line": "GET \/backend\/config.yml HTTP\/1.1",
"http_user_agent": "Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en) Presto\/2.12.423 Version\/12.16",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en)",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/config.yml",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/config.yml",
"request_line": "GET \/backend\/config.yml HTTP\/1.1",
"http_user_agent": "Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en) Presto\/2.12.423 Version\/12.16",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/config.yml",
"evidence_snippet": "GET \/backend\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Opera\/9.80 (J2ME\/MIDP; Opera Mini\/8.0.35626\/37.8918; U; en)",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /backend/settings.py
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/settings.py UA Mozilla/5.0 (compatible; Konqueror/4.1; OpenBSD) KHTML/4.1.4 (l…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/backend/settings.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/settings.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Django settings
Ligne de requête
GET /backend/settings.py HTTP/1.1
User-Agent
Mozilla/5.0 (compatible; Konqueror/4.1; OpenBSD) KHTML/4.1.4 (like Gecko)
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/settings.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (compatible; Konqueror/4.1; OpenBSD) KHTML/4.1
Requête brute (extrait)
GET /backend/settings.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (compatible; Konqueror/4.1; OpenBSD) KHTML/4.1.4 (like Gecko) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "83c0e32e69eba9274f9e92d080df837bf356678e",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "e3978a68997e27e7c0be3cc288a529b4c552616f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.3390625398616685,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "ef15583f48c6f39e5c7bf1750247a0a09f417580",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0112"
],
"matched_pattern_names": [
"LFI Django settings"
],
"pattern_ids": [
"pat-0112"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0679f15f42978304c84c40c87099f482",
"payload_hash": "a3b35da1875650bfedc46f64b7105d7d",
"path_pattern_hash": "3d2d12cf8593ec32b773f024d351f3c1"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/backend\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1",
"method": "GET",
"path": "\/backend\/settings.py",
"user_agent": "Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1.4 (like Gecko)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/settings.py HTTP\/1.1",
"request_sample": "GET \/backend\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1.4 (like Gecko)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1",
"evidence": {
"method": "GET",
"path": "\/backend\/settings.py",
"user_agent": "Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1.4 (like Gecko)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/settings.py HTTP\/1.1",
"request_sample": "GET \/backend\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1.4 (like Gecko)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0e720a8837bc4f043d9be21d863e9b597310225a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/settings.py",
"request_line": "GET \/backend\/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1.4 (like Gecko)",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/settings.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/settings.py",
"request_line": "GET \/backend\/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1.4 (like Gecko)",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/settings.py",
"evidence_snippet": "GET \/backend\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (compatible; Konqueror\/4.1; OpenBSD) KHTML\/4.1",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8300 · (tentative d'exploit) · → /backend/credentials.json
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /backend/credentials.json UA Mozilla/5.0 (Linux; Android 4.4.2; LG-V410 Build/KOT49I.V41010d…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/backend/credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /backend/credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 4.4.2; LG-V410 Build/KOT49I.V41010d) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.103 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/credentials.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; LG-V410 Build/KOT4
Requête brute (extrait)
GET /backend/credentials.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; LG-V410 Build/KOT49I.V41010d) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.103 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: g
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "88165737931b542e3294be2341cf6add85287b62",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "1d732992b15a0cfe1b56da6de3ddfe20a175465b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 282,
"payload_entropy": 5.472947939473359,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b1511434d7f7150e25359b5017a23fd9744d0875",
"event_fingerprint": "10212b5d86e9bb61dc1dfdbe8b8239421d15e950",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "0e4863bfb200799969e5ab0c5624cfc5",
"payload_hash": "521033b403e04405905140f0ac4f90ae",
"path_pattern_hash": "64fae7bd3390e1f6c8522c04f3546e30"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/backend\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT4",
"method": "GET",
"path": "\/backend\/credentials.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT49I.V41010d) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.103 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/credentials.json HTTP\/1.1",
"request_sample": "GET \/backend\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT49I.V41010d) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: g",
"payload_snippet": "GET \/backend\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT4",
"evidence": {
"method": "GET",
"path": "\/backend\/credentials.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT49I.V41010d) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.103 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/credentials.json HTTP\/1.1",
"request_sample": "GET \/backend\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT49I.V41010d) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.103 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: g",
"payload_snippet": "GET \/backend\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT4",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5f876ed4ea014cac4c82b714063f16a080c66c89",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/credentials.json",
"request_line": "GET \/backend\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT49I.V41010d) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.159\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT4",
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/credentials.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/credentials.json",
"request_line": "GET \/backend\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT49I.V41010d) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.159\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/credentials.json",
"evidence_snippet": "GET \/backend\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.2; LG-V410 Build\/KOT4",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8300 · (tentative d'exploit) · → /backend/secrets.json
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /backend/secrets.json UA Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_k8s_probe
Cible HTTP
GET
/backend/secrets.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/secrets.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0496
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets JSON file
Ligne de requête
GET /backend/secrets.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.310.0 Safari/532.9
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/secrets.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebK
Requête brute (extrait)
GET /backend/secrets.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.310.0 Safari/532.9 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "df5e6af17ab64ffe149b257d7b2e35d75a020458",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "0c0bf77b408e02e044169c2aa168db42e695df97",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.360554066245067,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "6a52b8a9a9d15de93a8a84473ed829b334a3a634",
"event_fingerprint": "25f8c12a34496ab47f28f20ee4b75a7a8bdc5679",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0496"
],
"matched_pattern_names": [
"Cred Secrets JSON file"
],
"pattern_ids": [
"pat-0496"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "d36b7d6765d67135068c163a5b34f235",
"payload_hash": "cda95a5a78fb7f32f19b81abb74982c7",
"path_pattern_hash": "bf437140e1da7868dd73544d7c53782c"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/backend\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebK",
"method": "GET",
"path": "\/backend\/secrets.json",
"user_agent": "Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit\/532.9 (KHTML, like Gecko) Chrome\/5.0.310.0 Safari\/532.9",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/secrets.json HTTP\/1.1",
"request_sample": "GET \/backend\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit\/532.9 (KHTML, like Gecko) Chrome\/5.0.310.0 Safari\/532.9\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebK",
"evidence": {
"method": "GET",
"path": "\/backend\/secrets.json",
"user_agent": "Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit\/532.9 (KHTML, like Gecko) Chrome\/5.0.310.0 Safari\/532.9",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/secrets.json HTTP\/1.1",
"request_sample": "GET \/backend\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit\/532.9 (KHTML, like Gecko) Chrome\/5.0.310.0 Safari\/532.9\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/backend\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebK",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4928ffc0ac7c9f42c3f3024125a5dbf03568997f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/secrets.json",
"request_line": "GET \/backend\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit\/532.9 (KHTML, like Gecko) Chrome\/5.0.310.0 Safari\/532.9",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebK",
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/secrets.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0496",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/secrets.json",
"request_line": "GET \/backend\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit\/532.9 (KHTML, like Gecko) Chrome\/5.0.310.0 Safari\/532.9",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/secrets.json",
"evidence_snippet": "GET \/backend\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebK",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_k8s_probe",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /backend/application.properties
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/application.properties UA Mozilla/5.0 (SymbianOS/9.4; U; Series60/5.0 SonyEricssonP100/01…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/backend/application.properties
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/application.properties
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/application.properties HTTP/1.1
User-Agent
Mozilla/5.0 (SymbianOS/9.4; U; Series60/5.0 SonyEricssonP100/01; Profile/MIDP-2.1 Configuration/CLDC-1.1) AppleWebKit/525 (KHTML, like Gecko) Version/3.0 Safari/525
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/application.properties HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (SymbianOS/9.4; U; Series60/5.0 Son
Requête brute (extrait)
GET /backend/application.properties HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (SymbianOS/9.4; U; Series60/5.0 SonyEricssonP100/01; Profile/MIDP-2.1 Configuration/CLDC-1.1) AppleWebKit/525 (KHTML, like Gecko) Version/3.0 Safari/525 Accept-Ch
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "properties",
"http_ua_hash": "f03f5ba0500dbd77ff637daf635b9a4067f72d42",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "528cd70dde060935667a9f06dea1d1aeda9a8b68",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 314,
"payload_entropy": 5.386961455888715,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "af5a8a3d8c34059f43bd538789293f7547fc2dd8",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "70a5596375fe73299194ae1708d1f629",
"payload_hash": "93464cfd88de9e8f4b2c08aea660bd5e",
"path_pattern_hash": "c0179fe480cd7004ee729d052802025a"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/backend\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 Son",
"method": "GET",
"path": "\/backend\/application.properties",
"user_agent": "Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 SonyEricssonP100\/01; Profile\/MIDP-2.1 Configuration\/CLDC-1.1) AppleWebKit\/525 (KHTML, like Gecko) Version\/3.0 Safari\/525",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/application.properties HTTP\/1.1",
"request_sample": "GET \/backend\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 SonyEricssonP100\/01; Profile\/MIDP-2.1 Configuration\/CLDC-1.1) AppleWebKit\/525 (KHTML, like Gecko) Version\/3.0 Safari\/525\r\nAccept-Ch",
"payload_snippet": "GET \/backend\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 Son",
"evidence": {
"method": "GET",
"path": "\/backend\/application.properties",
"user_agent": "Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 SonyEricssonP100\/01; Profile\/MIDP-2.1 Configuration\/CLDC-1.1) AppleWebKit\/525 (KHTML, like Gecko) Version\/3.0 Safari\/525",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/application.properties HTTP\/1.1",
"request_sample": "GET \/backend\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 SonyEricssonP100\/01; Profile\/MIDP-2.1 Configuration\/CLDC-1.1) AppleWebKit\/525 (KHTML, like Gecko) Version\/3.0 Safari\/525\r\nAccept-Ch",
"payload_snippet": "GET \/backend\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 Son",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c304f1b13f6a99a1bf9f5c2f368d648950cb3447",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/application.properties",
"request_line": "GET \/backend\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 SonyEricssonP100\/01; Profile\/MIDP-2.1 Configuration\/CLDC-1.1) AppleWebKit\/5\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 Son",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/application.properties",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/application.properties",
"request_line": "GET \/backend\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 SonyEricssonP100\/01; Profile\/MIDP-2.1 Configuration\/CLDC-1.1) AppleWebKit\/5\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/application.properties",
"evidence_snippet": "GET \/backend\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.4; U; Series60\/5.0 Son",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8300 · (tentative d'exploit) · → /src/config.json
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /src/config.json UA Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_sensitive_path
Cible HTTP
GET
/src/config.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/src/config.json
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/config.json HTTP/1.1
User-Agent
Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.114 Safari/537.36 Puffin/4.8.0.2965AT
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /src/config.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/537.36 (
Requête brute (extrait)
GET /src/config.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.114 Safari/537.36 Puffin/4.8.0.2965AT Accept-Charset: utf-8 Accept-Encoding: gzip Connec
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "2867558a8a8f83bc4d626242437291566c64da55",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "b4f7793f01d397f5d58e9094f00a03beca3a191b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 271,
"payload_entropy": 5.4477695914502835,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "8b6c81f3f707a44df21abac2e5bb864841dd56ef",
"event_fingerprint": "482ffdd763b3323bffa63738c974416b6e855c37",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7235a8cab859a9f68b9ff7960d50b124",
"payload_hash": "42afc3de26e032d47ba61beccd188ad1",
"path_pattern_hash": "937d3765bc6b1947cb6f2d196bad3bc9"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/src\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (",
"method": "GET",
"path": "\/src\/config.json",
"user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.114 Safari\/537.36 Puffin\/4.8.0.2965AT",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/config.json HTTP\/1.1",
"request_sample": "GET \/src\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.114 Safari\/537.36 Puffin\/4.8.0.2965AT\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/src\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (",
"evidence": {
"method": "GET",
"path": "\/src\/config.json",
"user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.114 Safari\/537.36 Puffin\/4.8.0.2965AT",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/config.json HTTP\/1.1",
"request_sample": "GET \/src\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.114 Safari\/537.36 Puffin\/4.8.0.2965AT\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnec",
"payload_snippet": "GET \/src\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3626d6503264a472b427c6485005e6c1b70574de",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/config.json",
"request_line": "GET \/src\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.114 Safari\/537.36 Pu\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (",
"attack_vector": "config file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/config.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/config.json",
"request_line": "GET \/src\/config.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/30.0.1599.114 Safari\/537.36 Pu\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/config.json",
"evidence_snippet": "GET \/src\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux x86_64; en-us) AppleWebKit\/537.36 (",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8300 · (tentative d'exploit) · → /src/secrets.json
Élevée
Élevé · 65
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /src/secrets.json UA Mozilla/5.0 (Linux; Android 9; GM1913) AppleWebKit/537.36 (KHTM…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
http_k8s_probe
Cible HTTP
GET
/src/secrets.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/src/secrets.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0496
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Secrets JSON file
Ligne de requête
GET /src/secrets.json HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; GM1913) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /src/secrets.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 9; GM1913) AppleWebKit/537.36 (KH
Requête brute (extrait)
GET /src/secrets.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 9; GM1913) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "52afa0c63fa89c52914758be7103e16b482e18dc",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "76d622f6c6848821dd36da7c88ae8c95c3d882f8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.372662747863289,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.4,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 65,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "6a52b8a9a9d15de93a8a84473ed829b334a3a634",
"event_fingerprint": "307eb676b449f9d3f30a2dfe4e6f0595f67667b6",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0496"
],
"matched_pattern_names": [
"Cred Secrets JSON file"
],
"pattern_ids": [
"pat-0496"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8a3e3eee7a039c5e5f6a9978df88c13d",
"payload_hash": "b38b085ed6532b7367f963695fc5f44a",
"path_pattern_hash": "f02699e8a3dcb9eae98b875a4eb77837"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "GET \/src\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KH",
"method": "GET",
"path": "\/src\/secrets.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/secrets.json HTTP\/1.1",
"request_sample": "GET \/src\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KH",
"evidence": {
"method": "GET",
"path": "\/src\/secrets.json",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/secrets.json HTTP\/1.1",
"request_sample": "GET \/src\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KH",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "288a9c15d80d3db68269dc88b8fa50ed8cf3937e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/secrets.json",
"request_line": "GET \/src\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KH",
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/secrets.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"pat-0496",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0496",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/secrets.json",
"request_line": "GET \/src\/secrets.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/secrets.json",
"evidence_snippet": "GET \/src\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; GM1913) AppleWebKit\/537.36 (KH",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_k8s_probe",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /backend/settings.json
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/settings.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/backend/settings.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/settings.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /backend/settings.json HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/settings.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWeb
Requête brute (extrait)
GET /backend/settings.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "465b4c97b6e69d085e4aefa5cb6c7dd7b79f707b",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "d227401356dbf11834ea71f41fab782a47e55e8d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 260,
"payload_entropy": 5.34185566973708,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d390d5f0c1e4a73e6f870e3b7f808aa01c4f741f",
"event_fingerprint": "7bef7f2d08bc24704101d93a466a0c3fce5715b3",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "cf8070654ecd18275e4a68fc8fabda92",
"payload_hash": "c311170c4a01c668d0e2e972614ffc01",
"path_pattern_hash": "3bc5c4fbb7fe3ed23eee2147536831d2"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/backend\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWeb",
"method": "GET",
"path": "\/backend\/settings.json",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/settings.json HTTP\/1.1",
"request_sample": "GET \/backend\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.2 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/backend\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWeb",
"evidence": {
"method": "GET",
"path": "\/backend\/settings.json",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.2 Safari\/605.1.15",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/settings.json HTTP\/1.1",
"request_sample": "GET \/backend\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.2 Safari\/605.1.15\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
"payload_snippet": "GET \/backend\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWeb",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "86cbb35292ff9e7b3e0959a90e85f63b70ea970f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/settings.json",
"request_line": "GET \/backend\/settings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.2 Safari\/605.1.15",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWeb",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/settings.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/settings.json",
"request_line": "GET \/backend\/settings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/605.1.15 (KHTML, like Gecko) Version\/12.0.2 Safari\/605.1.15",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/settings.json",
"evidence_snippet": "GET \/backend\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWeb",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /src/settings.py
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/settings.py UA Mozilla/5.0 (Linux; Android 9; SM-G973F) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/src/settings.py
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/src/settings.py
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Django settings
Ligne de requête
GET /src/settings.py HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /src/settings.py HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G973F) AppleWebKit/537.36 (K
Requête brute (extrait)
GET /src/settings.py HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 9; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "py",
"http_ua_hash": "58c309d4af7f366e6b4a3f2f73401e578ab326f2",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "d5789d665736cfa0ddfe8b823927e941f800dee5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 255,
"payload_entropy": 5.407768137979857,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "a498854ff55acfb2ff8c6a0fab99e15bd7989422",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0112"
],
"matched_pattern_names": [
"LFI Django settings"
],
"pattern_ids": [
"pat-0112"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f21e92d9de247922063a172257e34376",
"payload_hash": "48a5b689c0f0b8d09ba1483d706c5e7b",
"path_pattern_hash": "618ceab0c9dfa4ac1499dac941778116"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (K",
"method": "GET",
"path": "\/src\/settings.py",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/settings.py HTTP\/1.1",
"request_sample": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (K",
"evidence": {
"method": "GET",
"path": "\/src\/settings.py",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/settings.py HTTP\/1.1",
"request_sample": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (K",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a46adc7192c1eeb3e37af34b4dcf68ed80b4f86d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/settings.py",
"request_line": "GET \/src\/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (K",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/settings.py",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/settings.py",
"request_line": "GET \/src\/settings.py HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.89 Mobile Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/settings.py",
"evidence_snippet": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-G973F) AppleWebKit\/537.36 (K",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /server/application.properties
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /server/application.properties UA Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like G…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/server/application.properties
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/server/application.properties
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/application.properties HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.101 Safari/537.36 OPR/40.0.2308.62
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server/application.properties HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36
Requête brute (extrait)
GET /server/application.properties HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.101 Safari/537.36 OPR/40.0.2308.62 Accept-Charset: utf-8 Accept-Encoding: gzip Connecti
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "properties",
"http_ua_hash": "030d462e5f783b2f7a6d3df72886fa7e44f44071",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "e433f4a25bea9c7091dd294797aba9f705b3a3fe",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 269,
"payload_entropy": 5.381663888480542,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "d14657f759fe093e674c36dcb73fa2e48143ae1d",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f945ac294da8e6f76897ff3c7088826",
"payload_hash": "8f2d747d102479bd052f1998eb52f2c8",
"path_pattern_hash": "e3539cb3f1c980b2fa1f000afb7b6896"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/server\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36",
"method": "GET",
"path": "\/server\/application.properties",
"user_agent": "Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.101 Safari\/537.36 OPR\/40.0.2308.62",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/application.properties HTTP\/1.1",
"request_sample": "GET \/server\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.101 Safari\/537.36 OPR\/40.0.2308.62\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnecti",
"payload_snippet": "GET \/server\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36",
"evidence": {
"method": "GET",
"path": "\/server\/application.properties",
"user_agent": "Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.101 Safari\/537.36 OPR\/40.0.2308.62",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/application.properties HTTP\/1.1",
"request_sample": "GET \/server\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.101 Safari\/537.36 OPR\/40.0.2308.62\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnecti",
"payload_snippet": "GET \/server\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "462c6ad10636c4f7543bdb1536d3e0517c000d9a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/application.properties",
"request_line": "GET \/server\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.101 Safari\/537.36 OPR\/40.0.2308.62",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/application.properties",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/application.properties",
"request_line": "GET \/server\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/53.0.2785.101 Safari\/537.36 OPR\/40.0.2308.62",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/application.properties",
"evidence_snippet": "GET \/server\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/537.36",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8300 · (tentative d'exploit) · → /src/credentials.json
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /src/credentials.json UA Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Ge…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/src/credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/src/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /src/credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Gecko/2009060215 Firefox/3.0.11 (.NET CLR 3.5.30729)
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /src/credentials.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.
Requête brute (extrait)
GET /src/credentials.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Gecko/2009060215 Firefox/3.0.11 (.NET CLR 3.5.30729) Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "9635213bbf5b24c6f82a7bc5ec25046ba0a1c737",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "23f86bfe58cba1e2d3a32290ca4a4be3bab698c1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 253,
"payload_entropy": 5.331420691005176,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b1511434d7f7150e25359b5017a23fd9744d0875",
"event_fingerprint": "e441e28b1955cfde9d7f57cc7745d3e1f5e5fb15",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9c88fdd9f132c1dcd55a90de5bf84b55",
"payload_hash": "84bb25316a9ea41cee16c00d13b49a29",
"path_pattern_hash": "ca5cc487626db0683b9b18c892d55017"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/src\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.",
"method": "GET",
"path": "\/src\/credentials.json",
"user_agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Gecko\/2009060215 Firefox\/3.0.11 (.NET CLR 3.5.30729)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/credentials.json HTTP\/1.1",
"request_sample": "GET \/src\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Gecko\/2009060215 Firefox\/3.0.11 (.NET CLR 3.5.30729)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.",
"evidence": {
"method": "GET",
"path": "\/src\/credentials.json",
"user_agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Gecko\/2009060215 Firefox\/3.0.11 (.NET CLR 3.5.30729)",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/credentials.json HTTP\/1.1",
"request_sample": "GET \/src\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Gecko\/2009060215 Firefox\/3.0.11 (.NET CLR 3.5.30729)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/src\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c14a287cd996965b2c676642c0d91b546c58e3b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/credentials.json",
"request_line": "GET \/src\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Gecko\/2009060215 Firefox\/3.0.11 (.NET CLR 3.5.30729)",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.",
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/credentials.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/credentials.json",
"request_line": "GET \/src\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.11) Gecko\/2009060215 Firefox\/3.0.11 (.NET CLR 3.5.30729)",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/credentials.json",
"evidence_snippet": "GET \/src\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.0.",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /server/settings.json
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /server/settings.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/server/settings.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/server/settings.json
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /server/settings.json HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server/settings.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebK
Requête brute (extrait)
GET /server/settings.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: clos
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "7382b5f3b254c99a0d40bda7aefd386539e0be7a",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "828cdcc902d2d0915012e1403580e3433895b5c7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 261,
"payload_entropy": 5.401291685045573,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d390d5f0c1e4a73e6f870e3b7f808aa01c4f741f",
"event_fingerprint": "d2e6886d887d72250f4ec9e6c969d720935ad339",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6a2411e8c5387a0c6ebf7396c4178f0a",
"payload_hash": "91a4ddc7c640090ba69868dff298bf78",
"path_pattern_hash": "28fba90884643b291ca8ed06bf04078f"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/server\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebK",
"method": "GET",
"path": "\/server\/settings.json",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/settings.json HTTP\/1.1",
"request_sample": "GET \/server\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clos",
"payload_snippet": "GET \/server\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebK",
"evidence": {
"method": "GET",
"path": "\/server\/settings.json",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/settings.json HTTP\/1.1",
"request_sample": "GET \/server\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: clos",
"payload_snippet": "GET \/server\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebK",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "583f0ec16af1aa92903d6bdfc2b903176ed48ab6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/settings.json",
"request_line": "GET \/server\/settings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebK",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/settings.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/settings.json",
"request_line": "GET \/server\/settings.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.100 Safari\/537.\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/settings.json",
"evidence_snippet": "GET \/server\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebK",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /src/application.properties
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /src/application.properties UA Mozilla/5.0 (Linux; Android 7.1.2; Pixel Build/NHG47N) AppleWeb…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/src/application.properties
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/src/application.properties
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /src/application.properties HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 7.1.2; Pixel Build/NHG47N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.83 Mobile Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /src/application.properties HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Pixel Build/NHG4
Requête brute (extrait)
GET /src/application.properties HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Pixel Build/NHG47N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.83 Mobile Safari/537.36 Accept-Charset: utf-8 Accept-Encoding: gzi
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "properties",
"http_ua_hash": "deec2d162d6cbf4338565d93b8be913f7086553b",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "768d564965356c4daa1d64414a9bc4107eab2558",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 280,
"payload_entropy": 5.392549031902458,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "81d45ac58bb094128c5e03f9ce4ed1f44b650c6f",
"event_fingerprint": "a70ae8a57e5319addaa82cb273ecb2efc1325e5e",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 177,
"precision_signals": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fdd11b9c43dfec5401240ffacd44073b",
"payload_hash": "00515ff3e4494b9c40c81a45a4153a02",
"path_pattern_hash": "db2b25e0227df53a411ba0201f54fb0e"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG4",
"method": "GET",
"path": "\/src\/application.properties",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG47N) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/58.0.3029.83 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/application.properties HTTP\/1.1",
"request_sample": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG47N) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/58.0.3029.83 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzi",
"payload_snippet": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG4",
"evidence": {
"method": "GET",
"path": "\/src\/application.properties",
"user_agent": "Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG47N) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/58.0.3029.83 Mobile Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/src\/application.properties HTTP\/1.1",
"request_sample": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG47N) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/58.0.3029.83 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzi",
"payload_snippet": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG4",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e7d6595683ad6b283c6d7659569a745df6486ff8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/application.properties",
"request_line": "GET \/src\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG47N) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/58.0.3029.83 Mobil\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG4",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/application.properties",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"MITRE-T1499",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/src\/application.properties",
"request_line": "GET \/src\/application.properties HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG47N) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/58.0.3029.83 Mobil\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/src\/application.properties",
"evidence_snippet": "GET \/src\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Pixel Build\/NHG4",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Flood / DDoS
http flood · via HTTP:8300 · (tentative d'exploit) · → /backend/database.yml
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
T1499
TA0001
TA0002
Protocole
GET /backend/database.yml UA Mozilla/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-d…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/backend/database.yml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/backend/database.yml
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1499
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Database YAML
Ligne de requête
GET /backend/database.yml HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit/534.46.0 (KHTML, like Gecko) CriOS/19.0.1084.60 Mobile/9B206 Safari/7534.48.3
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /backend/database.yml HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X
Requête brute (extrait)
GET /backend/database.yml HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit/534.46.0 (KHTML, like Gecko) CriOS/19.0.1084.60 Mobile/9B206 Safari/7534.48.3 Accept-Charset: utf-8 Accep
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "yml",
"http_ua_hash": "070766d822f3ae79d339a01ac7e2a8d026922a6b",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "25a2d98e6a2c7dd23e193680fa9bacac3e7bc9fa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 295,
"payload_entropy": 5.4597400629557145,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d390d5f0c1e4a73e6f870e3b7f808aa01c4f741f",
"event_fingerprint": "94d4a1a0686ffaa43256f9291ed3c28d66eb15c0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 122,
"precision_signals": [
"MITRE-T1499"
],
"kb_rule_ids": [
"MITRE-T1499"
],
"matched_patterns": [
"pat-0474"
],
"matched_pattern_names": [
"Cred Database YAML"
],
"pattern_ids": [
"pat-0474"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "3291cc6611a68cd117de00faf9944f4f",
"payload_hash": "373cc6864f2cd46f8086f1f20d278ff5",
"path_pattern_hash": "093366cc927a8512059dfdc7be5f5e49"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/backend\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X",
"method": "GET",
"path": "\/backend\/database.yml",
"user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1084.60 Mobile\/9B206 Safari\/7534.48.3",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/database.yml HTTP\/1.1",
"request_sample": "GET \/backend\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1084.60 Mobile\/9B206 Safari\/7534.48.3\r\nAccept-Charset: utf-8\r\nAccep",
"payload_snippet": "GET \/backend\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X",
"evidence": {
"method": "GET",
"path": "\/backend\/database.yml",
"user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1084.60 Mobile\/9B206 Safari\/7534.48.3",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/backend\/database.yml HTTP\/1.1",
"request_sample": "GET \/backend\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1084.60 Mobile\/9B206 Safari\/7534.48.3\r\nAccept-Charset: utf-8\r\nAccep",
"payload_snippet": "GET \/backend\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1499"
],
"mitre": "T1499",
"threat_family": [
"ddos"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "178a8f581663c49cb8c555201d77f351538c0ad2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/database.yml",
"request_line": "GET \/backend\/database.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X",
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/database.yml",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1499"
],
"tags_summary_labels_fr": [
"MITRE-T1499"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1499",
"mitre_technique": "T1499",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/database.yml",
"request_line": "GET \/backend\/database.yml HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X; da-dk) AppleWebKit\/534.46.0 (KHTML, like Gecko) CriOS\/19.0.1\u2026",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http flood \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/database.yml",
"evidence_snippet": "GET \/backend\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 5_1_1 like Mac OS X",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}
15/06/2026 12:38:25 UTC
TCP
8300 · HTTP
Sonde fichier credential / clé
credential file probe · via HTTP:8300 · (tentative d'exploit) · → /server/credentials.json
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /server/credentials.json UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/536.…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_flood
Cible HTTP
GET
/server/credentials.json
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/server/credentials.json
Pourquoi cette classification : Sonde fichier sensible: fichier credential/clé · Règle WAF « rce-0 » · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0472
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Credentials JSON
Ligne de requête
GET /server/credentials.json HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/536.3 (KHTML, like Gecko) Chrome/19.0.1063.0 Safari/536.3
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /server/credentials.json HTTP/1.1
Host: 62.3.50.33:8300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWe
Requête brute (extrait)
GET /server/credentials.json HTTP/1.1 Host: 62.3.50.33:8300 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/536.3 (KHTML, like Gecko) Chrome/19.0.1063.0 Safari/536.3 Accept-Charset: utf-8 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "json",
"http_ua_hash": "b5219f197fa37f9a176e16ea3a66d5e9fb587f43",
"http_host_hash": "372950b7e517660af40b2015a2d8c9118c97a68c",
"http_target_hash": "0448476e8596bfb535234584ac471c02983c6fe7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 259,
"payload_entropy": 5.349635810470948,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 8300,
"risk_waf": 84,
"risk_classification": 82,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 64,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b1511434d7f7150e25359b5017a23fd9744d0875",
"event_fingerprint": "489dfa19735d406db0b9f4934d01889987ee1e32",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 135,
"precision_signals": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0472"
],
"matched_pattern_names": [
"Cred Credentials JSON"
],
"pattern_ids": [
"pat-0472"
],
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"named_classification_skipped": false,
"classification_parent": "lfi_attack",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "379e3f73ea0b0c7d993340f8397a3672",
"payload_hash": "f930134b22a986f126b065a2a18c02c1",
"path_pattern_hash": "017fc0dcd972a4e3aefd53875717b41b"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"payload_preview": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWe",
"method": "GET",
"path": "\/server\/credentials.json",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/credentials.json HTTP\/1.1",
"request_sample": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWe",
"evidence": {
"method": "GET",
"path": "\/server\/credentials.json",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/server\/credentials.json HTTP\/1.1",
"request_sample": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r",
"payload_snippet": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWe",
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bbcaf6734e0f43b38ea574a63b4c1e0dc212f466",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/credentials.json",
"request_line": "GET \/server\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWe",
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/credentials.json",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 82,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 64,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"pat-0472",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"pat-0472",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/server\/credentials.json",
"request_line": "GET \/server\/credentials.json HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "credential file probe \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/server\/credentials.json",
"evidence_snippet": "GET \/server\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8300\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWe",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"consul-server",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_flood"
],
"asn_dc_heuristic": true
}